Cyber security enhanced monitoring

Patent metadata

Field	Value
Publication number	US-11722505-B2
Application number	US-202117395839-A
Country	US
Kind code	B2
Filing date	Aug 6, 2021
Priority date	Sep 26, 2017
Publication date	Aug 8, 2023
Grant date	Aug 8, 2023

Abstract

Systems for and methods of detecting cyber-attacks by selecting a group of users and monitoring those user's computer systems for behavior that indicates a series of actions reflecting behavior indicative of a cyber-attack.

First claim

What is claimed is:

1. A system for detecting behavior associated with a potential security breach of an enterprise, the system comprising:
a computing device;
a network in communication with the computer device;
a baseline generation and monitoring system in communication with the network;
a correlation and alert generator in communication with the network; and
a memory storing instructions that when executed, cause the baseline generation and monitoring system to:
identify an employee of the enterprise that represents an elevated risk of contributing to the potential security breach where the computing device is associated with the employee;
develop a plurality of use cases based on the identified employee by using a cyber-attack methodology,
wherein the plurality of use cases are developed for at least one first step related to delivering a cyber-attack, at least one second step related to installing an attacking tool, at least one third step related to communicating with an external source, and at least one fourth step related to performing an attack action;

store a list of predetermined behaviors corresponding to the plurality of use cases that are indicative of the potential security breach;
determine a baseline for each of the predetermined behaviors in the list;
monitor the computing device associated with the identified employee for occurrence of a first behavior that exceeds the corresponding baseline;
monitor the first behavior of the computing device for an occurrence of a second behavior that is related to the first behavior; and
generate an alert using the correlation and alert generator when both the first behavior and second behavior occurs.

2. The system of claim 1 , wherein the baseline generation and monitoring system is further configured to determine the elevated security risk based on criticality of the employee, extra-organizational threat intelligence, and input from an organization of which the employee is a member.

3. The system of claim 1 , further comprising an event log which stores a history of computing device activity.

4. The system of claim 3 , further comprising instructions that when executed, cause the baseline generation and monitoring system to:
normalize the computing device activity stored in the event log; and
generate a whitelist of activities from the normalized computing device activity.

5. The system of claim 4 , further comprising instructions that cause the baseline generation and monitoring system to:
analyze a data feed comprising asset inventory information to identify new assets; and
add predicted activities related to deploying the new assets to the whitelist of activities.

6. The system of claim 1 , wherein the baseline is determined for at least one of: email activity, process activity, installations, register modifications, new proxy connections, new user agents, new user connections, new source authorizations, new attempted accesses, or new outbound data connections.

7. A method of detecting behavior associated with a potential security breach of an enterprise, the method comprising:
identifying an employee of the enterprise that represents an elevated risk of contributing to the potential security breach;
developing a plurality of use cases based on the identified employee by using a cyber-attack methodology,
wherein the plurality of use cases are developed for at least one first step related to delivering a cyber-attack, at least one second step related to installing an attacking tool, at least one third step related to communicating with an external source, and at least one fourth step related to performing an attack action;

providing a list of predetermined behaviors corresponding to the plurality of use cases that are indicative of the potential security breach;
determining a baseline for each of the predetermined behaviors in the list;
monitoring network activity associated with the identified employee for occurrence of any of the predetermined behaviors that exceeds the corresponding baseline; and
generating an alert when the occurrence of at least one of the predetermined behaviors is detected from the network activity.

8. The method of claim 7 , further comprising storing the network activity associated with the employee in an event log.

9. The method of claim 8 , further comprising:
normalizing the network activity stored in the event log that is related to the predetermined behaviors indicative of the potential security breach; and
generating a whitelist of network activities from the normalized network activity.

10. The method of claim 9 , wherein monitoring the network activity associated with the employee for occurrence of any of the predetermined behaviors comprises:
monitoring the network activity; and
detecting a breach network activity related to the predetermined behaviors indicative of the potential security breach that is not included on the whitelist of network activities.

11. The method of claim 9 , wherein a data feed comprised of asset inventory information is analyzed to identify new assets and predicted network activities related to deploying these new assets, and wherein the predicted network activities are added to the whitelist of network activities.

12. The method of claim 7 , wherein the employee is identified based on criticality of the employee, extra-organizational threat intelligence, and input from an organization of which the employee is a member.

13. The method of claim 7 , wherein the baseline of the predetermined behaviors indicative of the potential security breach is determined for at least one of: email activity, process activity, installations, register modifications, new proxy connections, new user agents, new user connections, new source authorizations, new attempted accesses, or new outbound data connections.

14. A method of detecting behavior associated with a potential security breach of an enterprise, the method comprising:
identifying an employee of the enterprise that represents an elevated risk of contributing to the potential security breach;
providing a list of predetermined behaviors indicative of the potential security breach;
storing network activity of the employee in an event log;
determining a baseline for each of the predetermined behaviors in the list, the predetermined behaviors including at least one of email activity, process activity, installations, register modifications, new proxy connections, new user agents, new user connections, new source authorizations, new attempted accesses, or new outbound data connections;
generating a whitelist of network activities from the network activity;
developing a plurality of use cases based on the employee by using a cyber-attack methodology,
wherein the plurality of use cases are developed for at least one first step related to delivering a cyber-attack, at least one second step related to installing an attacking tool, at least one third step related to communicating with an external source, and at least one fourth step related to performing an attack action;

monitoring the network activity;
detecting a first network activity that is not included on the whitelist of network activities;
comparing the detected first network activity to the plurality of use cases;
when the detected first network activity satisfies a first use case, monitoring the network activity for a second network activity that satisfies a second use case that is related to the first use case; and
generating an alert when the second network activity is detected.

15. The method of claim 14 , wherein identifying an employee that repr

Assignees

• Jpmorgan Chase Bank Na

Inventors

• Kyle Mackenzie
• Arnold Benjamin
• Gunner Bradley N
• Kondeti Rohith
• Monte Michael

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L43/065 Primary

  related to network devices · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• H04L41/0893

  Assignment of logical groups to network elements · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title