Dynamic filtering of endpoint event streams

Patent metadata

Field	Value
Publication number	US-2020076833-A1
Application number	US-201816129087-A
Country	US
Kind code	A1
Filing date	Sep 12, 2018
Priority date	Aug 31, 2018
Publication date	Mar 5, 2020
Grant date	—

Abstract

Activity on an endpoint is monitored in two stages with a local agent. In a first stage, particular computing objects on the endpoint are selected for tracking. In a second stage, particular types of changes to those objects are selected. By selecting objects and object changes in this manner, a compact data stream of information highly relevant to threat detection can be provided from an endpoint to a central threat management facility. In order to support dynamic threat response, the locus and level of detection applied by the local agent can be controlled by the threat management facility and/or the endpoint.

First claim

What is claimed is:

1 . A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
instrumenting an endpoint with a local agent to detect a plurality of types of changes to a plurality of computing objects; creating an event stream from the local agent including each type of change to each of the plurality of computing objects detected on the endpoint; storing the event stream in a data recorder on the endpoint; processing the event stream with a filter at the endpoint to provide a filtered event stream including a subset of the types of changes to a subset of the plurality of computing objects; transmitting the filtered event stream to a threat management facility; processing the filtered event stream at the threat management facility to evaluate a security state of the endpoint; and in response to a predetermined security state detected by the threat management facility, transmitting an adjustment to the endpoint for at least one of the types of changes or computing objects used by the filter to process the event stream.

2 . The computer program product of claim 1 wherein the plurality of computing objects includes a number of files.

3 . The computer program product of claim 1 wherein the plurality of computing objects includes a number of processes.

4 . The computer program product of claim 1 wherein the plurality of computing objects includes a number of executables.

5 . The computer program product of claim 1 wherein the plurality of computing objects includes at least one of an electronic communication, a registry of system settings, and a secure kernel cache.

6 . A method comprising:
receiving a filtered event stream from an endpoint at a threat management facility for an enterprise network, the filtered event stream including a subset of types of changes to a subset of computing objects from a plurality of types of changes to a plurality of computing objects monitored by a data recorder on the endpoint; processing the filtered event stream at the threat management facility to evaluate a security state of the endpoint; and in response to a predetermined change in the security state of the endpoint, transmitting an adjustment to a filter used by the endpoint to select which of the plurality of types of changes to the plurality of computing objects the data recorder reports in the filtered event stream.

7 . The method of claim 6 wherein the subset of computing objects includes one or more of a file, an executable, a process, a database, and a message.

8 . The method of claim 6 wherein the types of changes include at least one of a file read, a file write, a file copy, a file encrypt, a file decrypt, a network communication, a registry update, a software installation, a change in permissions, and a query to a remote resource.

9 . The method of claim 6 further comprising correlating the filtered event stream to a malware event on the endpoint and searching for the malware event on one or more other endpoints coupled to the enterprise network based on a pattern of events in the filtered event stream.

10 . The method of claim 6 further comprising storing the filtered event stream at the threat management facility.

11 . The method of claim 6 further comprising storing an unfiltered event stream on the data recorder at the endpoint, the unfiltered event stream including additional ones of the plurality of types of changes to the plurality of computing objects.

12 . The method of claim 6 further comprising storing an unfiltered event stream on the data recorder at the endpoint, the unfiltered event stream including one or more of the plurality of types of changes to additional ones of the plurality of computing objects.

13 . The method of claim 6 wherein processing the filtered event stream includes searching for potential malicious activity on the endpoint.

14 . The method of claim 6 wherein processing the filtered event stream includes searching for a security exposure on the endpoint.

15 . The method of claim 6 further comprising, when the filtered event stream shows that the security state of the endpoint is compromised, initiating a remedial action.

16 . The method of claim 6 wherein processing the filtered event stream includes securely verifying a status of the endpoint.

17 . The method of claim 6 wherein the adjustment includes a change to the subset of types of changes included in the filtered event stream.

18 . The method of claim 6 wherein the adjustment includes a change to the subset of computing objects included in the event stream.

19 . A system comprising:
an endpoint executing a data recorder to store an event stream including a plurality of types of changes to a plurality of computing objects detected on the endpoint, the endpoint further executing a local agent to process the event stream with a filter into a filtered event stream including a subset of the plurality of types of changes to a subset of the plurality of computing objects, the local agent further configured to communicate the filtered event stream to a remote resource over a data network; and a threat management facility configured to receive the filtered event stream from the endpoint and to process the filtered event stream to evaluate a security state of the endpoint, the threat management facility further configured to respond to a predetermined change in the security state by transmitting an adjustment to the endpoint for at least one of the types of changes or computing objects used by the filter to process the event stream.

20 . The system of claim 19 wherein the threat management facility is further configured to initiate a remediation of the endpoint when the security state of the endpoint is compromised.

Assignees

• Sophos Ltd

Inventors

• Ladnai Beata
• Harris Mark David
• Smith Andrew G P
• Ray Kenneth D
• Thomas Andrew J
• Humphries Russell

Classifications

• G06Q10/06395

  Quality analysis or management · CPC title

• G06Q10/0635 Primary

  Risk analysis of enterprise or organisation activities · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• G06F21/565

  by checking file integrity · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title