System and method for detecting security risks in a computer system

Patent metadata

Field	Value
Publication number	US-10909242-B2
Application number	US-201816169081-A
Country	US
Kind code	B2
Filing date	Oct 24, 2018
Priority date	Oct 25, 2017
Publication date	Feb 2, 2021
Grant date	Feb 2, 2021

Abstract

A system and method are provided for identifying security risks in a computer system. The system includes an event stream generator configured to collect system event data from the computer system. The system further includes a query device configured to receive query requests that specify parameters of a query. Each query request includes at least one anomaly model. The query request and the anomaly model are included in a first syntax in which a system event is expressed as {subject-operation-object}. The system further includes a detection device configured to receive at least one query request from the query device and continuously compare the system event data to the anomaly models of the query requests to detect a system event that poses a security risk. The system also includes a reporting device configured to generate an alert for system events that pose a security risk detected by the detection device.

First claim

What is claimed is:

1. A system for identifying security risks in a computer system, comprising:
an event stream generator configured to collect system event data from the computer system;
a query device configured to receive query requests, each query request including at least one anomaly model, wherein the query request and the anomaly model are specified in a first syntax expressing a system event as {subject-operation-object}, the subject being a system entity of the computer system, the operation being initiated by the subject and targeted on the object;
a detection device configured to receive at least one query request from the query device and continuously compare the system event data in the first syntax to the anomaly models of the query requests to detect a given system event that poses a security risk; and
a reporting device configured to generate an alert for system events that pose a security risk detected by the detection device.

2. The system of claim 1 , wherein the query requests include a single-event query.

3. The system of claim 1 , wherein the query requests include a multi-event query.

4. The system of claim 1 , wherein the query requests include at least one of the following parameters selected from the group consisting of event temporal relationship constraints, system event patterns and global constraints for at least one anomaly model.

5. The system of claim 1 , wherein the query requests include a rule-based anomaly model.

6. The system of claim 1 , wherein the system further includes a computation device configured to receive the system event data and compute measurements concerning the system event data, including state data.

7. The system of claim 6 , wherein:
the query requests include a time-series anomaly model; and
the detection device is configured to receive state data for sliding time windows from the computation device to detect a system event that poses a security risk.

8. The system of claim 6 , wherein:
the detection device further includes a training device that is configured to receive a query request that includes an invariant-based anomaly model;
the training device is configured to perform a query during a training period and detect invariants during the training period; and
the detection device is configured to incorporate the invariants detected during the training period in the invariant-based anomaly model.

9. The system of claim 6 , wherein:
the query requests include an outlier-based anomaly model;
the detection device is configured to receive state data from the computation device concerning a plurality of peer processes;
the detection device further includes an identification device that is configured to determine outliers in the state data for the plurality of peer processes; and
the detection device is configured to compare the outliers in the state data to the outlier-based anomaly model to detect a system event that poses a security risk.

10. The system of claim 1 , wherein:
the system further includes an optimization device that is configured to perform semantic, lexical and syntactic analysis of the query requests to group the query requests; and
the optimization device is configured to schedule the detection device to perform the query requests for a determined group via a master-dependent-query scheme.

11. A computer-implemented method for identifying security risks in a computer system, comprising:
collecting system event data from the computer system; and
receiving query requests, each query request including at least one anomaly model, wherein the query request and the anomaly model are specified in a first syntax expressing a system event as {subject-operation-object}, the subject being a system entity of the computer system, the operation being initiated by the subject and targeted on the object;
comparing the system event data in the first syntax to the anomaly models of the query requests to detect a given system event that poses a security risk; and
generating an alert for system events that pose a security risk.

12. The computer-implemented method of claim 11 , wherein the query requests include a single-event query.

13. The computer-implemented method of claim 11 , wherein the query requests include a multi-event query.

14. The computer-implemented method of claim 11 , wherein the query requests include at least one of the following parameters: event temporal relationship constraints, system event patterns and global constraints for at least one anomaly model.

15. The computer-implemented method of claim 11 , wherein the query requests include a rule-based anomaly model.

16. The computer-implemented method of claim 11 , further comprising:
receiving the system event data; and
computing measurements concerning the system event data, including state data.

17. The computer-implemented method of claim 16 , wherein:
the query requests include a time-series anomaly model; and
state data for sliding time windows is used as the system event data for the comparing to the anomaly models to detect a system event that poses a security risk.

18. The computer-implemented method of claim 16 , further comprising:
receiving a query request that includes an invariant-based anomaly model;
performing a query during a training period and detecting invariants during the training period; and
incorporating the invariants detected during the training period in the invariant-based anomaly model.

19. The computer-implemented method of claim 16 , wherein:
the query requests include an outlier-based anomaly model;
state data is received concerning a plurality of peer processes;
outliers in the state data are determined for the plurality of peer processes; and
the outliers in the state data are compared to the outlier-based anomaly model to detect a system event that poses a security risk.

20. The computer-implemented method of claim 11 , further comprising:
performing semantic, lexical and syntactic analysis of the query requests to group the query; and
performing the query requests via a master-dependent-query scheme for a determined group.

Assignees

• Nec Lab America Inc
• Nec Corp

Inventors

• Li Ding
• Xiao Xusheng
• Li Zhichun
• Jiang Guofei
• Gao Peng

Classifications

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title

• G06F16/24568

  Data stream processing; Continuous queries · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F16/3335

  Syntactic pre-processing, e.g. stopword elimination, stemming · CPC title

• G06F9/542

  Event management; Broadcasting; Multicasting; Notifications · CPC title