Active prioritization of investigation targets in network security

Patent metadata

Field	Value
Publication number	US-10904271-B2
Application number	US-201715789022-A
Country	US
Kind code	B2
Filing date	Oct 20, 2017
Priority date	Oct 20, 2017
Publication date	Jan 26, 2021
Grant date	Jan 26, 2021

Abstract

In one embodiment, a device analyzes network traffic data using a clustering process, to identify a cluster of addresses associated with the network traffic data for which the associated network traffic has similar behavioral characteristics. The device calculates a set of rankings for the cluster by comparing the cluster to different sets of malicious addresses. The device aggregates the set of rankings into a final ranking by setting the rankings in the set as current rankings and iteratively calculating an average of any subset of the current rankings that comprises correlated rankings. The calculated average replaces the rankings in the subset as a current ranking. When none of the current rankings are correlated, the device performs an aggregation across all of the current rankings to form the final ranking. The device provides data indicative of the cluster for review by a supervisor, based on the final ranking.

First claim

What is claimed is:

1. A method, comprising:
analyzing, by a device, network traffic data of a computer network using a clustering process to identify a cluster of computer network addresses associated with the network traffic data for which associated network traffic of the network traffic data has similar behavioral characteristics;
determining, by the device, a set of rankings that rank the cluster of computer network addresses and a plurality of other clusters of computer network addresses by comparing the cluster of computer network addresses to different sets of computer network addresses deemed malicious, the set of rankings indicative of a priority for review of the cluster of computer network addresses with respect to the plurality of other clusters of computer network addresses;
aggregating, by the device, the set of rankings into a final ranking by setting rankings in the set as current rankings and iteratively:
calculating an average of any subset of the current rankings that comprises correlated rankings, wherein the calculated average replaces the rankings in the subset as a current ranking, and
when none of the current rankings are correlated, performing an aggregation across all of the current rankings to form the final ranking; and

providing, by the device and based on the final ranking of the cluster of computer network addresses, data indicative of the cluster of computer network addresses to an automation-based review system, wherein the automation-based review system is configured to confirm whether the cluster of computer network addresses is malicious.

2. The method as in claim 1 , wherein at least one of the different sets of computer network addresses deemed malicious comprises a blacklist of computer network addresses.

3. The method as in claim 1 , wherein at least one of the different sets of computer network addresses deemed malicious comprises a set of computer network addresses with which malware in a sandbox environment attempted to communicate.

4. The method as in claim 1 , wherein the cluster of computer network addresses comprises a set of network domains.

5. The method as in claim 1 , wherein performing the aggregation across all of the current rankings to form the final ranking comprises:
performing round robin aggregation across all of the current rankings to form the final ranking.

6. The method as in claim 5 , wherein the round robin aggregation comprises active round robin aggregation, and wherein performing the round robin aggregation across all of the current rankings comprises:
using feedback from a user interface to adjust the current rankings.

7. The method as in claim 1 , wherein performing the aggregation across all of the current rankings to form the final ranking comprises:
performing repeat-until-fail aggregation across all of the current rankings to form the final ranking.

8. The method as in claim 1 , wherein performing the aggregation across all of the current rankings to form the final ranking comprises:
performing probabilistic rank aggregation across all of the current rankings to form the final ranking.

9. The method as in claim 1 , further comprising:
determining a correlation coefficient between two or more of the current rankings; and
when the correlation coefficient is above a predefined threshold, flagging the sets of computer network addresses deemed malicious that are associated with the two or more current rankings as redundant.

10. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
analyze network traffic data of the network using a clustering process, to identify a cluster of computer network addresses associated with the network traffic data for which associated network traffic of the network traffic data has similar behavioral characteristics;
determine a set of rankings that rank the cluster of computer network addresses and a plurality of other clusters of computer network addresses by comparing the cluster of computer network addresses to different sets of computer network addresses deemed malicious, the set of rankings indicative of a priority for review of the cluster of computer network addresses with respect to the plurality of other clusters of computer network addresses;
aggregate the set of rankings into a final ranking by setting rankings in the set as current rankings and iteratively:
calculating an average of any subset of the current rankings that comprises correlated rankings, wherein the calculated average replaces the rankings in the subset as a current ranking, and
when none of the current rankings are correlated, performing an aggregation across all of the current rankings to form the final ranking; and

provide, based on the final ranking of the cluster of computer network addresses, data indicative of the cluster of computer network addresses to an automation-based review system, wherein the automation-based review system is configured to confirm whether the cluster of computer network addresses is malicious.

11. The apparatus as in claim 10 , wherein at least one of the different sets of computer network addresses deemed malicious comprises a blacklist of computer network addresses.

12. The apparatus as in claim 10 , wherein at least one of the different sets of computer network addresses deemed malicious comprises a set of computer network addresses with which malware in a sandbox environment attempted to communicate.

13. The apparatus as in claim 10 , wherein the cluster of computer network addresses comprises a set of network domains.

14. The apparatus as in claim 10 , wherein the apparatus performs the aggregation across all of the current rankings to form the final ranking by:
performing round robin aggregation across all of the current rankings to form the final ranking.

15. The apparatus as in claim 14 , wherein the round robin aggregation comprises active round robin aggregation, and wherein the apparatus performs the round robin aggregation across all of the current rankings by:
using feedback from a user interface to adjust the current rankings.

16. The apparatus as in claim 10 , wherein the apparatus performs the aggregation across all of the current rankings to form the final ranking by:
performing repeat-until-fail aggregation across all of the current rankings to form the final ranking.

17. The apparatus as in claim 10 , wherein the apparatus performs the aggregation across all of the current rankings to form the final ranking by:
performing probabilistic rank aggregation across all of the current rankings to form the final ranking.

18. The apparatus as in claim 10 , wherein the process when executed is further configured to:
determine a correlation coefficient between two or more of the current rankings; and
when the correlation coefficient is above a predefined threshold, flag the sets of computer network addresses deemed malicious that are associated with the two or more current rankings as redundant.

19. The apparatus as in claim 10 , wherein the apparatus provides the data indicative of the cluster of computer network addresses for review by a supervisor by:
providing the data indicative of the cluster of computer network addresses to a user interface.

20. A tangible, non-transitory, computer-readable medium storing program ins

Assignees

• Cisco Tech Inc

Inventors

• Jusko Jan
• Stiborek Jan
• Pevny Tomas

Classifications

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title