Similarity search for discovering multiple vector attacks

Patent metadata

Field	Value
Publication number	US-2017346839-A1
Application number	US-201715668580-A
Country	US
Kind code	A1
Filing date	Aug 3, 2017
Priority date	Dec 5, 2014
Publication date	Nov 30, 2017
Grant date	—

Abstract

A similarity search may be performed on a digraph to identify additional attack vectors that are potentially under attack in response to an initial attack vector being under attack. Security event data that includes attack histories of assets and threat actor data on threat actors are received. A digraph that maps threat actors to attack vectors of the assets is generated based on the attack histories. A risk probability of attack may be calculated for an attack vector of an asset based on the digraph, such that the attack vector may be determined to be under attack in response to the risk probability exceeding a predetermined probability threshold. Subsequently, a similarity search on the digraph may be performed in view of the attack vector that is determined to be under attack to identify additional attack vectors of the asset or another other asset that are potentially under attack.

First claim

What is claimed is:

1 . One or more non-transitory computer-readable media of a user device storing computer-executable instructions that upon execution cause one or more processors to perform acts comprising:
receiving security event data that includes attack histories of one or more assets of an enterprise and threat actor data on one or more threat actors that are capable of attacks on the one or more assets of the enterprise; generating a digraph that maps threat actors to attack vectors of the one or more assets of the enterprise based on the attack histories; determining that an attack vector of an asset is under attack in response to a risk probability of attack that is calculated for the attack vector based on the digraph exceeding a predetermined probability threshold; and performing a similarity search on the digraph in view of the attack vector that is determined to be under attack to identify one or more additional attack vectors of the asset or at least one other asset that are potentially under attack.

2 . The one or more non-transitory computer-readable media of claim 1 , wherein the acts further comprise generating a threat model that includes the additional attack vectors that are potentially under attack.

3 . The one or more non-transitory computer-readable media of claim 2 , wherein the threat model is a recombination threat model that identifies a plurality of threat vectors and responses to at least one of prevent, contain, or eliminate attacks on the plurality of threat vectors.

4 . The one or more non-transitory computer-readable media of claim 1 , wherein the acts further comprise generating a data report that identifies the attack vector that is under attack and the one or more additional vectors that are potentially under attack in real-time or on a periodic basis.

5 . The one or more non-transitory computer-readable media of claim 1 , wherein the acts further comprise:
receiving new attack data that indicates one or more previously unknown historical attacks or new attacks on an additional asset from one or more security applications; generating an updated digraph to account for the new attack data received from the one or more security applications; determining that the additional attack vector of an asset is under attack in response to an additional risk probability of attack that is calculated for the additional attack vector based on the updated digraph exceeding the predetermined probability threshold; and performing a similarity search on the digraph in view of the additional attack vector that is determined to be under attack to identify one or more other attack vectors of the asset or at least one other asset that are potentially under attack.

6 . The one or more non-transitory computer-readable media of claim 5 , wherein the new attack data indicates an attack on an attack vector belonging to an asset of the enterprise or a comparable asset of another enterprise.

7 . The one or more non-transitory computer-readable media of claim 1 , wherein the performing the similarity search includes performing a topological similarity search, a semantics-based similarity search, a statistical similarity search or the digraph.

8 . The one or more non-transitory computer-readable media of claim 1 , wherein the performing the similarity search includes:
ascertaining a baseline attribute value of the attack vector of the asset that is under attack, the baseline attribute value quantifying or qualifying an attribute of the attack vector; determining a target attribute value for an additional attack vector of the asset or another asset of the enterprise, the target attribute value quantifying or qualifying an additional attribute of the additional attack vector that is identical to the attribute of the attack vector; generating a similarity score for the baseline attribute value and the target attribute value based on a normalized sum of pairwise attribute similarities between the baseline attribute value and the target attribute value; determining that the additional attack vector is at risk of attack in response to the similarity score exceeding a similarity score threshold; and determining that the additional vector is not at risk of attack in response to the similarity score being less than or equal to the similar score threshold.

9 . The one or more non-transitory computer-readable media of claim 1 , wherein the digraphs include nodes that represent assets and edges connecting the nodes represent relationships between the nodes, the edges including a bidirectional edge or a unidirectional edge.

10 . The one or more non-transitory computer-readable media of claim 9 , wherein the bidirectional edge represents mutual data exchange between a pair of nodes, and wherein the unidirectional edge represents a one-way data flow between another pair of nodes.

11 . The one or more non-transitory computer-readable media claim 1 , wherein the security event data includes data from at least one of a Security information and Event Management (SIEM) application, an Intrusion Detection System (IDS), or a vulnerability scanner that is operated by the enterprise or a third-party that is external to the enterprise.

12 . A computing device, comprising:
one or more processors; and memory including a plurality of computer-executable components that are executable by the one or more processors to perform a plurality of actions, the plurality of actions comprising:
receiving security event data that includes attack histories of one or more assets of an enterprise and threat actor data on one or more threat actors that are capable of attacks on the one or more assets of the enterprise;
generating a digraph that maps threat actors to attack vectors of the one or more assets of the enterprise based on the attack histories;
receiving new attack data that indicates one or more previously unknown historical attacks or new attacks on at least one asset from one or more security applications;
generating an updated digraph to account for the new attack data received from the one or more security applications;
determining that an attack vector of an asset is under attack in response to a risk probability of attack that is calculated for the attack vector based on the updated digraph exceeding a predetermined probability threshold; and
performing a similarity search on the updated digraph in view of the attack vector that is determined to be under attack to identify one or more additional attack vectors of the asset or at least one other asset that are potentially under attack.

13 . The computing device of claim 12 , wherein the plurality of actions further comprise generating a threat model that includes the additional attack vectors that are potentially under attack.

14 . The computing device of claim 12 , wherein the acts further comprise generating a data report that identifies the attack vector that is under attack and the one or more additional vectors that are potentially under attack in real-time or on a periodic basis.

15 . The computing device of claim 12 , wherein the performing the similarity search includes performing a topological similarity search, a semantics-based similarity search, a statistical similarity search or the digraph.

16 . The computing device of claim 12 , wherein the performing the similarity search includes:
ascertaining a baseline attribute value of the attack vector of the asset that is under attack, the baseline attribute value quantifying or qualifying an attribute of the attack vector; determining a target attribute value fo

Assignees

• T Mobile Usa Inc

Inventors

• Peppe Brett C
• Reith Gregory R

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title