System and method for monitoring security attack chains

Patent metadata

Field	Value
Publication number	US-11212299-B2
Application number	US-201916401052-A
Country	US
Kind code	B2
Filing date	May 1, 2019
Priority date	May 1, 2018
Publication date	Dec 28, 2021
Grant date	Dec 28, 2021

Abstract

A cybersecurity platform is described that processes collected data using a data model to identify and link anomalies and in order to identify generate security events and intrusions. The platform generates graph data structures using the security anomalies extended using additional data. The graph data structures represent links between nodes, the links being events, the nodes being machines and user accounts. The platform processes the graph data structures by combining similar nodes or grouping security events with common features to behaviour indicative of a single or multiple security events to identify chains of events which together represent an attack.

First claim

What is claimed is:

1. A cybersecurity computing system comprising a processor and a memory storing machine executable instructions to configure the processor to:
collect data from different data points in a network;
process the collected data using a data model to identify anomalies and generate security events, each event having descriptive data indicating a security threat;
correlate and store data elements representing the security events and the anomalies in a data store;
extract event metadata not considered to represent security incidents and combine the metadata with the security events;
generate graph data structures using the security events and the event metadata, the graph data structures indicating links between nodes, the links being events, the nodes being machines;
collect and store the graph data structures in the data store;
process the graph data structures by combining nodes or grouping security events with common features;
determine that a processed graph data structure represents an earlier stage of a stored graph data structure that represents an attack;
generate a confidence measure and a measure of stability of an internet protocol (IP) address associated with each event; and
generate and transmit security alerts using the processed graph data structures, based on the confidence measure and the measure of stability.

2. The cybersecurity computing system of claim 1 , wherein the descriptive data indicates the security threat comprising a potential severity of the event, a probability that the event is not security related, and a reference to a stage of an attack that the event can correspond to.

3. The cybersecurity computing system of claim 1 , wherein each security event indicating potential attack data, identification of users that may be implicated by the event, identification of machines that may be implicated by the event, and time data.

4. The cybersecurity computing system of claim 1 , wherein the processor is configured to label the graph data structures with the descriptive data.

5. The cybersecurity computing system of claim 4 , wherein the descriptive data comprises a risk rating, a weighting or probability indicating likelihood that the security event is a false positive, the time the security event occurred, what phase of an attack lifecycle the security event potentially corresponds to, and the frequency of observed occurrences.

6. The cybersecurity computing system of claim 1 , wherein the processor is configured to implement additional processing of the security events before storing in the data store by leveraging external and internal data linked to the events.

7. The cybersecurity computing system of claim 1 , wherein the collected data comprises machine relationship data indicating trust relationships between machines.

8. The cybersecurity computing system of claim 1 , wherein the processor is configured to process the graph data structures based on a time analysis of security events based on a relation to an attack framework.

9. The cybersecurity computing system of claim 1 , wherein the processor is configured to process the graph data structures based on a density of the nodes in the graph data structures.

10. The cybersecurity computing system of claim 1 , wherein the processor is configured to process the graph data structures based on graph outliers identified using clustering or neural networks.

11. The cybersecurity computing system of claim 1 , wherein the processor is configured to process the graph data structures by identifying graph outliers using statistical models.

12. The cybersecurity computing system of claim 1 , wherein the processor is configured to process the graph data structures by identifying graph data structures to known attacks using neural networks.

13. The cybersecurity computing system of claim 1 , wherein the processor is configured to process the graph data structures by classification of the graph data structures by the number and diversity of their nodes.

14. The cybersecurity computing system of claim 1 , wherein the processor is configured to process the graph data structures using predictions of likely future security events.

15. A method for monitoring cybersecurity attack chains, the method comprising:
at a processor,
collecting data from different data points in a network;
processing the collected data using a data model to identify anomalies and generate generating security events, each event having descriptive data indicating a security threat;
correlating and storing the data elements representing the security events and the anomalies in a data store, the data store storing previously generated security events;
extracting event metadata not considered to represent security incidents and combining the event metadata with the security events;
generating graph data structures using the security events and the event metadata, the graph data structures indicating links between nodes, the links being events, the nodes being machines;
collecting and storing the graph data structures in the data store;
processing the graph data structures by combining nodes or grouping security events with common features;
determining that a processed graph data structure represents an earlier stage of a stored graph data structure that represents an attack;
generating a confidence measure and a measure of stability of an internet protocol (IP) address associated with each event; and
generating and transmitting security alerts using the processed graph data structures, based on the confidence measure and the measure of stability.

16. The method of claim 15 , wherein the descriptive data indicates the security threat comprising a potential severity of the event, a probability that the event is not security related, and a reference to a stage of an attack that the event can correspond to.

17. The method of claim 15 , wherein each security event indicating potential attack data, identification of users that may be implicated by the event, identification of machines that may be implicated by the event, and time data.

18. The method of claim 15 , wherein the processor is configured to label the graph data structures with the descriptive data.

19. The method of claim 15 , wherein the descriptive data comprises a risk rating, a weighting or probability indicating likelihood that the security event is a false positive, the time the security event occurred, what phase of an attack lifecycle the security event potentially corresponds to, and the frequency of observed occurrences.

20. A non-transitory computer-readable medium storing machine executable instructions, which when executed on a processor, cause the processor to perform a method for monitoring cybersecurity attack chains, the method comprising:
collecting data from different data points in a network;
processing the collected data using a data model to identify anomalies and generating security events, each event having descriptive data indicating a security threat;
correlating and storing the data elements representing the security events and the anomalies in a data store, the data store storing previously generated security events;
extracting event metadata not considered to represent security incidents and combining the metadata with the security events;
generating graph data structures using the security events and the event metadata, the graph data structures indicating links between nodes, the links being events, the nodes being machines;
determining that a processed grap

Assignees

• Royal Bank Of Canada

Inventors

• Gamble Jamie
• Rahmani Sahar
• Tiwari Amitkumar

Classifications

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F16/9024

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title