Risky behavior query construction and execution

Patent metadata

Field	Value
Publication number	US-10860582-B2
Application number	US-201615364489-A
Country	US
Kind code	B2
Filing date	Nov 30, 2016
Priority date	Jan 29, 2016
Publication date	Dec 8, 2020
Grant date	Dec 8, 2020

Abstract

Systems and a method are provided. A system includes a Temporal Behavior Query Language (TBQL) server having a processor and a memory operably coupled to the processor. The TBQL server configured to construct a TBQL query using a grammar inference technique based on syntactic sugar to expedite query construction. The TBQL server is further configured to execute the TBQL query to generate TBQL query results.

First claim

What is claimed is:

1. A system, comprising:
a Temporal Behavior Query Language (TBQL) server having a processor and a memory operably coupled to the processor, the TBQL server configured for:
constructing a TBQL query using a grammar inference technique based on syntactic sugar to expedite query construction, the constructing comprising utilizing a syntax configured for directly specifying relationships between two or more events, the relationships including an attribute relationship configured for utilizing attributes of a first event to constrain a search of another event, and a temporal relationship configured for utilizing temporal information of the first event to constrain the search of the another event;
executing the TBQL query to generate TBQL query results; and
tracking dependencies between the two or more events over time for a plurality of hosts, with a temporal order of events at a same host being strictly enforced based on a sequence number assigned to one or more deployed agents from among a plurality of agents, and a temporal order of the events at different hosts being adjusted based on network events matched between the different hosts,
wherein the TBQL server is configured to execute the TBQL query using a data partitioning performance optimization that comprises partitioning query related data based on an involved agent from among the plurality of agents.

2. The system of claim 1 , wherein the TBQL server constructs the TBQL query by selectively constructing at least one of a multi-event query and a path query.

3. The system of claim 2 , wherein the multi-event query is used as a sub-query for another multi-event query.

4. The system of claim 2 , wherein the multi-event query is formed from one or more single-event queries.

5. The system of claim 1 , wherein the data partitioning performance optimization comprises partitioning query related data based on an involved time.

6. The system of claim 1 , wherein the TBQL server constructs the TBQL queries relating to a set of monitored systems.

7. The system of claim 6 , wherein the at least some of the TBQL queries are directed to risky behaviors relating to the set of monitored systems.

8. A computer-implemented method, comprising:
constructing, by a Temporal Behavior Query Language (TBQL) server having a processor and a memory operably coupled to the processor, a TBQL query using a grammar inference technique based on syntactic sugar to expedite query construction, the constructing comprising utilizing a syntax configured for directly specifying relationships between two or more events, the relationships including an attribute relationship configured for utilizing attributes of a first event to constrain a search of another event, and a temporal relationship configured for utilizing temporal information of the first event to constrain the search of the another event;
executing, by the TBQL server, the TBQL query to generate TBQL query results; and
tracking, by the TBQL server, dependencies between the two or more events over time for a plurality of hosts, with a temporal order of events at a same host being strictly enforced based on a sequence number assigned to one or more deployed agents from among a plurality of agents, and a temporal order of the events at different hosts being adjusted based on network events matched between the different hosts,
wherein the TBQL server is configured to execute the TBQL query using a data partitioning performance optimization that comprises partitioning query related data based on an involved agent from among the plurality of agents.

9. The computer-implemented method of claim 8 , wherein the TBQL query is constructed by selectively constructing at least one of a multi-event query and a path query.

10. The computer-implemented method of claim 9 , wherein the multi-event query is used as a sub-query for another multi-event query.

11. The computer-implemented method of claim 9 , wherein the multi-event query is formed from one or more single-event queries.

12. The computer-implemented method of claim 8 , wherein the TBQL query is executed using a data partitioning performance optimization.

13. The computer-implemented method of claim 12 , wherein the data partitioning performance optimization comprises partitioning query related data based on an involved time.

14. The computer-implemented method of claim 12 , wherein the data partitioning performance optimization comprises partitioning query related data based on an involved agent.

15. The computer-implemented method of claim 8 , wherein the TBQL queries are constructed to relate to a set of monitored systems.

16. The computer-implemented method of claim 15 , wherein the at least some of the TBQL queries are directed to risky behaviors relating to the set of monitored systems.

17. A system, comprising:
a Temporal Behavior Query Language (TBQL) server having a processor and a memory operably coupled to the processor, the TBQL server configured for:
constructing a TBQL query based on user input using a grammar inference technique based on syntactic sugar to expedite query construction, the constructing comprising utilizing a syntax configured for directly specifying relationships between two or more events, the relationships including an attribute relationship configured for utilizing attributes of a first event to constrain a search of another event, and a temporal relationship configured for utilizing temporal information of the first event to constrain the search of the another event;
tracking dependencies between the two or more events over time for a plurality of hosts, with a temporal order of events at a same host being strictly enforced based on a sequence number assigned to one or more deployed agents from among a plurality of agents, and a temporal order of the events at different hosts being adjusted based on network events matched between the different hosts, and
executing the TBQL query using at least one data partitioning technique that partitions query related data based on an involved time and an involved agent from among the plurality of agents.

18. The system of claim 17 , wherein the TBQL server constructs the TBQL query by selectively constructing at least one of a multi-event query and a path query.

Assignees

• Nec Lab America Inc
• Nec Corp

Inventors

• Xiao Xusheng
• Li Zhichun
• Xu Fengyuan
• Gao Peng
• Jiang Guofei

Classifications

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F16/2448

  for particular applications; for extensibility, e.g. user defined types · CPC title

• G06F16/242

  Query formulation · CPC title

• G06F16/245

  Query processing · CPC title

• G06F21/00

  Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title