Cyber threat intelligence threat and vulnerability assessment of service supplier chain

Patent metadata

Field	Value
Publication number	US-10812519-B2
Application number	US-201715857815-A
Country	US
Kind code	B2
Filing date	Dec 29, 2017
Priority date	Dec 29, 2016
Publication date	Oct 20, 2020
Grant date	Oct 20, 2020

Abstract

Determining the cyber threat risk and vulnerability of an organization may be determined taking in to account the chain of service suppliers to the organization.

First claim

What is claimed is:

1. A method of assessing a vulnerability exposure of an organization comprising:
generating enrichment data by:
collecting, by a plurality of network devices, network reporting information; and
adding one or more tags of enrichment data to the network reporting information based at least in part on a portion of the network reporting information;

summarizing the enrichment data and storing as summary network data;
accessing stored summary network data for an organization over a monitoring period;
determining suppliers of services to the organization based on the summary network data;
determining a supplier vulnerability exposure of each of the suppliers of services to the organization; and
determining the vulnerability exposure of the organization including a weighting of the determined supplier vulnerability exposure of each of the suppliers of services.

2. The method of claim 1 , wherein summarizing network data comprises:
generating for the monitoring period one or more session summaries of network flows occurring in the network data.

3. The method of claim 2 , further comprising:
generating one or more organization traffic and threat summaries over the monitoring period.

4. The method of claim 3 , wherein each of the one or more session summaries of network flows comprise one or more of:
a client IP address;
a client organization;
a client industry;
a client country;
a server IP address;
a server organization;
a server industry;
a server country;
a transport protocol;
a service port;
a traffic direction;
a NetFlow sampling resolution;
a minimum, a maximum, a total duration of sessions during the monitoring period;
a minimum, a maximum, a total number of packets of sessions during the monitoring period;
a minimum, a maximum, a total number of bytes of sessions during the monitoring period;
the total flows; and
a matrix of total flows in slices of time smaller than the monitoring period; and
wherein each of the one or more daily organization traffic and threat summaries comprises one or more of:
an organization;
an industry;
a destination IP;
a destination organization;
a destination industry;
a destination country;
a destination threat indicator;
a total number of flows in and out; and
a total number of bytes in and out.

5. The method of claim 3 , wherein the monitoring period is one or more of:
an hour;
a day;
a week; and
a month.

6. The method of claim 1 , wherein suppliers of services to the organization are determined from the stored summary network data based on a service port of one or more communication flows associated with a supplier of a service, a transport protocol of the one or more communication flows associated with the supplier of the service and an amount of traffic transmitted between the supplier of the service and the organization.

7. The method of claim 1 , further comprising one or more of:
storing the determined vulnerability exposure;
using the determined vulnerability exposure to determine if one or more alerts should be generated; and
displaying an indication of the determined vulnerability exposure.

8. A system for assessing a vulnerability exposure of an organization comprising:
a plurality of network devices each collecting network reporting information; and
a collection of at least on cyber-threat intelligence (CTI) infrastructure server, the collection configured for:
generating enrichment data by adding one or more tags of enrichment data to the network reporting information based at least in part on a portion of the network reporting information;
summarizing the enrichment data and storing the summarized enrichment data as summary network data;
accessing stored summary network data for an organization over a monitoring period;
determining suppliers of services to the organization based on the summary network data;
determining a supplier vulnerability exposure of each of the suppliers of services to the organization; and
determining the vulnerability exposure of the organization including a weighting of the determined supplier vulnerability exposure of each of the suppliers of services.

9. The system of claim 8 , wherein summarizing network data comprises:
generating for the monitoring period one or more session summaries of network flows occurring in the network data.

10. The system of claim 9 , wherein the collection is further configured for:
generating one or more organization traffic and threat summaries over the monitoring period.

11. The system of claim 10 , wherein each of the one or more session summaries of network flows comprise one or more of:
a client IP address;
a client organization;
a client industry;
a client country;
a server IP address;
a server organization;
a server industry;
a server country;
a transport protocol;
a service port;
a traffic direction;
a NetFlow sampling resolution;
a minimum, a maximum, a total duration of sessions during the monitoring period;
a minimum, a maximum, a total number of packets of sessions during the monitoring period;
a minimum, a maximum, a total number of bytes of sessions during the monitoring period;
the total flows; and
a matrix of total flows in slices of time smaller than the monitoring period; and
wherein each of the one or more daily organization traffic and threat summaries comprises one or more of:
an organization;
an industry;
a destination IP;
a destination organization;
a destination industry;
a destination country;
a destination threat indicator;
a total number of flows in and out; and
a total number of bytes in and out.

12. The system of claim 10 , wherein the monitoring period is one or more of:
an hour;
a day;
a week; and
a month.

13. The system of claim 8 , wherein suppliers of services to the organization are determined from the stored summary network data based on a service port of one or more communication flows associated with a supplier of a service, a transport protocol of the one or more communication flows associated with the supplier of the service and an amount of traffic transmitted between the supplier of the service and the organization.

14. The system of claim 8 , wherein the collection is further configured for one or more of:
storing the determined vulnerability exposure;
using the determined vulnerability exposure to determine if one or more alerts should be generated; and
displaying an indication of the determined vulnerability exposure.

15. A non-transitory computer readable medium having stored thereon software instructions that, when executed, cause a method of assessing a vulnerability exposure of an organization to be performed, the method comprising:
generating enrichment data by:
collecting, by a plurality of network devices, network reporting information; and
adding one or more tags of enrichment data to the network reporting information based at least in part on a portion of the network reporting information;

summarizing the enrichment data and storing as summary network data;
accessing stored summary network data for an organization over a monitoring period;
determining suppliers of services to the organization based on the summary network data;
determining a supplier vulnerability exposure of each of the suppliers of services to the organization; and
determining the vulnerability exposure of the organization including a weighting of the determined supplier vulnerability exposure of each of the suppliers of services.

16. The non-transitory computer readable medium of clai

Assignees

• Bce Inc

Inventors

• Broda Maciej
• Hervieux Marc-Andre
• Habib Hakem

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title