Cyber security sharing and identification system

Patent metadata

Field	Value
Publication number	US-10873603-B2
Application number	US-201815923949-A
Country	US
Kind code	B2
Filing date	Mar 16, 2018
Priority date	Feb 20, 2014
Publication date	Dec 22, 2020
Grant date	Dec 22, 2020

Abstract

Systems and techniques for sharing security data are described herein. Security rules and/or attack data may be automatically shared, investigated, enabled, and/or used by entities. A security rule may be enabled on different entities comprising different computing systems to combat similar security threats and/or attacks. Security rules and/or attack data may be modified to redact sensitive information and/or configured through access controls for sharing.

First claim

What is claimed is:

1. A computer implemented method comprising:
by a computer system comprising one or more computer hardware processors and one or more storage devices,
communicating with a plurality of entities;
receiving security attack data from a first entity of the plurality of entities, the security attack data comprising information regarding one or more first security attacks;
identifying, based on sharing rules associated with the first entity, one or more recipient entity of a subset of the plurality of entities that are authorized to access a ruleset from the first entity; and
facilitating sharing of the ruleset from the first entity to the one or more recipient entity,
wherein the ruleset (i) is determined by the first entity, and (ii) is associated with the security attack data,
wherein the ruleset comprises instructions selectably applicable by the one or more recipient entity to detect a potential security attack,
wherein the instructions are configured to:
in response to detecting the potential security attack, add data associated with the potential security attack to a cluster as a seed, wherein the cluster comprises a plurality of connected objects and a representation of the cluster is displayable in a user interface.

2. The computer implemented method of claim 1 , wherein the sharing rules associated with the first entity further exclude sharing ruleset data from the first entity to particular one or more entities.

3. The computer implemented method of claim 1 , wherein the ruleset further comprises second instructions configured to:
access one or more data objects associated with the one or more recipient entity, the one or more data objects comprising a plurality of network communications.

4. The computer implemented method of claim 3 , wherein the one or more data objects further comprise a first user login object and a second user login object, the first user login object comprising data indicating a first login for a particular user at a first time and a first location, the second user login object comprising data indicating a second login for the particular user at a second time and a second location, and wherein the ruleset further comprises third instructions configured to:
calculate, from first user login object and the second user login object, a duration of time between the first time for the first login and the second time for the second login;
calculate, from first user login object and the second user login object, a distance between the first location for the first login and the second location for the second login;
calculate a speed from the duration of time and the distance; and
determine the potential security attack where the speed is greater than a threshold value.

5. The computer implemented method of claim 4 , wherein the ruleset further comprises fourth instructions configured to:
in response to determining the potential security attack, generate an alert.

6. Non-transitory computer storage medium comprising instructions for causing one or more computing devices to perform operations comprising:
communicating with a plurality of entities;
receiving security attack data from a first entity of the plurality of entities, the security attack data comprising information regarding one or more first security attacks;
identifying, based on sharing rules associated with the first entity, one or more recipient entity of a subset of the plurality of entities that are authorized to access a ruleset from the first entity; and
transmitting at least a portion of a ruleset from the first entity to the one or more recipient entity,
wherein the ruleset (i) is determined by the first entity, and (ii) is associated with the security attack data,
wherein the ruleset comprises instructions selectably applicable by the one or more recipient entity to detect a potential security attack,
wherein the instructions are configured to:
in response to detecting the potential security attack, add data associated with the potential security attack to a cluster as a seed, wherein the cluster comprises a plurality of connected objects and a representation of the cluster is displayable in a user interface.

7. The non-transitory computer storage medium of claim 6 , wherein the sharing rules associated with the first entity further exclude sharing ruleset data from the first entity to particular one or more entities.

8. The non-transitory computer storage medium of claim 6 , wherein the ruleset further comprises second instructions configured to:
access one or more data objects associated with the one or more recipient entity, the one or more data objects comprising a plurality of network communications.

9. The non-transitory computer storage medium of claim 6 , wherein the ruleset further comprises second instructions configured to:
receive a user agent identifier for a first login;
perform, at the one or more recipient entity, a search for the user agent identifier, wherein performing the search further comprises:
determining that the user agent identifier is a new user agent identifier; and

in response to determining that the user agent identifier is a new user agent identifier, generate an alert.

10. A system for sharing security information, the system comprising:
one or more computer processors executing code instructions, to:
communicate with a plurality of entities;
receive security attack data from a first entity of the plurality of entities, the security attack data comprising information regarding one or more first security attacks;
identify, based on sharing rules associated with the first entity, one or more recipient entity of a subset of the plurality of entities that are authorized to access ruleset data from the first entity; and
facilitate sharing of at least a portion of a ruleset from the first entity to the one or more recipient entity,
wherein the ruleset (i) is determined by the first entity, and (ii) is associated with the security attack data,
wherein the ruleset comprises instructions selectably applicable by the one or more recipient entity to detect a potential security attack,
wherein the instructions are configured to:
in response to detecting the potential security attack, add data associated with the potential security attack to a cluster as a seed, wherein the cluster comprises a plurality of connected objects and a representation of the cluster is displayable in a user interface.

11. The system of claim 10 , wherein the ruleset further comprises second instructions configured to:
access one or more data objects associated with the one or more recipient entity, the one or more data objects comprising a plurality of network communications.

12. The system of claim 10 , wherein the ruleset further comprises second instructions configured to:
identify a first login for a particular user at a first time and a first location;
identify a second login for the particular user at a second time and a second location;
calculate a duration of time between the first time for the first login and the second time for the second login;
calculate a distance between the first location for the first login and the second location for the second login;
calculate a speed from the duration of time and the distance; and
determine the potential security attack where the speed is greater than a threshold value.

13. The system of claim 12 , wherein the ruleset further comprises third instructions configured to:
in response to determining the potential security attack, generate an alert.

14. The system of claim 10 , wherein the one or more computer proces

Assignees

• Palantir Technologies Inc

Inventors

• Albertson Jacob
• Hildebrandt Melody
• Singh Harkirat
• Sankar Shyam
• Ducott Rick
• Maag Peter
• Kimball Marissa

Classifications

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title