System and method for attribution of actors to indicators of threats to a computer system and prediction of future threat actions

Patent metadata

Field	Value
Publication number	US-10587640-B2
Application number	US-201614997761-A
Country	US
Kind code	B2
Filing date	Jan 18, 2016
Priority date	Jan 18, 2016
Publication date	Mar 10, 2020
Grant date	Mar 10, 2020

Abstract

An information handling system performs a method for analyzing attacks against a networked system of information handling systems. The method includes detecting a threat indicator, representing the threat indicator in part by numerical parameters, normalizing the numerical parameters, calculating one or more measures of association between the threat indicator and other threat indicators, finding an association of the threat indicator with another threat indicator based upon the normalized numerical parameters, and assigning to the threat indicator a probability that a threat actor group caused the attack, wherein the threat actor group was assigned to the other threat indicator. In some embodiments, the normalizing may include transforming a distribution of the numerical parameters to a distribution with a standard deviation of 1 and a mean of 0. In some embodiments, the normalizing may include applying an empirical cumulative distribution function. In some embodiments, the one or more measures of association between the threat indicator and other threat indicators may include a Kendall's tau between the threat indicator and the other threat indicators, a covariance between the threat indicator and the other threat indicators; or a conditional entropy between the threat indicator and the other threat indicators.

First claim

What is claimed is:

1. A computer implemented method, the computer having a processor and memory, the method comprising:
detecting by the computer a threat indicator that provides an indication of an attack against a networked system of information handling systems;
representing the threat indicator in part by numerical parameters;
normalizing the numerical parameters;
calculating one or more measures of association between the threat indicator and other threat indicators based upon the normalized numerical parameters;
finding an association of the threat indicator with another threat indicator based upon the one or more measures of association, wherein the other threat indicator provides an indication of another attack, the other attack attributed to a threat actor group;
attributing the attack to the threat actor group based upon the association;
assigning to the threat indicator a probability that the threat actor group caused the attack;
assessing a risk to the networked system based upon the threat actor group and the probability; and
determining a defense posture for the networked system based upon the risk.

2. The computer implemented method of claim 1 , wherein the normalizing comprises applying an empirical cumulative distribution function.

3. The computer implemented method of claim 1 , wherein the finding the association comprises calculating a Kendall's tau between the threat indicator and the other threat indicator.

4. The computer implemented method of claim 1 , wherein the finding the association comprises calculating a covariance between the threat indicator and the other threat indicator.

5. The computer implemented method of claim 1 , wherein the finding the association comprises calculating a conditional entropy between the threat indicator and the other threat indicator.

6. The computer implemented method of claim 1 , wherein the finding the association comprises determining that at least one of a conditional entropy between the threat indicator and the other threat indicator, a Kendall's tau between the threat indicator and the other threat indicator, and a covariance between the threat indicator and the other threat indicator is a maximal value of the set of conditional entropies between the threat indicator and other threat indicators, the set of Kendall's tau between the threat indicator and the other threat indicators, and the set of covariance between the threat indicator and the other threat indicators.

7. The computer implemented method of claim 1 , wherein the finding the association comprises determining that a combination of a conditional entropy between the threat indicator and the other threat indicator, a Kendall's tau between the threat indicator and the other threat indicator, and a covariance between the threat indicator and the other threat indicator produces a maximal value of the combination between the threat indicator and other threat indicators.

8. The computer implemented method of claim 1 , wherein the assigning the probability comprises performing a regression analysis on the normalized numerical parameters and the one or more measures of association.

9. The computer implemented method of claim 8 , wherein the performing the regression analysis comprises performing a probit regression analysis.

10. The computer implemented method of claim 8 , wherein the performing the regression analysis comprises performing a logistic regression analysis.

11. The computer implemented method of claim 1 , wherein the assessing the risk to the networked system comprises:
generating a set of potential actions Â;
receiving an input logistic prediction model {circumflex over (β)}, wherein {circumflex over (β)} describes a relationship between predictors and a probability that one of the set of potential actions  will be taken; and
applying the model {circumflex over (β)} to values of the predictors, thereby producing propensity scores.

12. The computer implemented method of claim 1 , wherein the assigning the probability comprises calculating a probability that the threat actor group caused the attack according to the formula:

LI
⁢

⁢

K
⁡

(

Y
+

,

Y
r

,

Y
τ

,

Y
h

)

=

e

β
^

⁡

(

Y
+

⁢

;

⁢

⁢

Y
r

,

Y
τ

,

Y
h

)

1
+

e

β
^

⁡

(

Y
+

⁢

;

⁢

⁢

Y
r

,

Y
τ

,

Y
h

)

wherein: {circumflex over (β)} is

Assignees

• Secureworks Corp

Inventors

• Steelman Doug M
• Wiedman Todd
• Deitz Kenneth A
• Herren Berlene
• Deal Edgar L
• Clements Thomas
• Miller Brian

Classifications

• H04L2463/146

  Tracing the source of attacks · CPC title

• H04L63/0209

  Architectural arrangements, e.g. perimeter networks or demilitarized zones · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F17/18

  for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} · CPC title

• H04L63/1491

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title