Method and system for automated incident response

Patent metadata

Field	Value
Publication number	US-9386041-B2
Application number	US-201414473866-A
Country	US
Kind code	B2
Filing date	Aug 29, 2014
Priority date	Jun 11, 2014
Publication date	Jul 5, 2016
Grant date	Jul 5, 2016

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for implementing a response to one or more security incidents in a computing network. One of the methods includes identifying a security incident based on detecting one or more indicators of compromise associated with the security incident, comparing the security incident with a predefined ontology that maps the security incident to one or more courses of action, selecting a response strategy that includes one or more of the courses of action, and implementing the response strategy as an automated response.

First claim

What is claimed is:

1. A method for implementing a response to one or more security incidents in a computing network, comprising:
receiving, by a threat intelligence device of the computing network and from one or more data feed sources external to the computing network, information related to one or more previously identified computing network security threats;
based at least in part on the information related to the one or more previously identified computing network security threats, determining, by the threat intelligence device, one or more observable indicators of compromise for at least one of the one or more previously identified computing network security threats;
receiving, by a security information and analytics device of the computing network and from the threat intelligence device, the one or more observable indicators of compromise;
continually monitoring, by the security information and analytics device, one or more computing network data sources internal to the computing network for occurrences of security incidents and identifying, by the security information and analytics device, a security incident as an occurrence of a particular computing network security threat from the one or more previously identified computing network security threats, based on detecting one or more of the one or more observable indicators of compromise for the particular computing network security threat;
comparing, by the security and analytics device, the security incident with a predefined ontology that maps the security incident to one or more courses of action, the one or more courses of action including workflow steps to be performed in response to the security incident;
selecting, by the security and analytics device, a response strategy that includes the one or more courses of action and providing, by the security and analytics device to an automated incident response device of the computing network, instructions for implementing the response strategy; and
implementing, by the automated incident response device, the response strategy as an automated response including, for each workflow step of the one or more courses of action, performing the workflow step, receiving forensics information related to performing the workflow step from a host agent of the automated incident response device, and providing the forensics information to a forensics repository.

2. The method of claim 1 , wherein the one or more observable indicators of compromise indicate a security threat to the computing network, and wherein the one or more observable indicators of compromise have been previously prioritized based at least in part on potential effectiveness in preventing or mitigating the security threat.

3. The method of claim 2 , wherein the indicators of compromise include one or more of a process name, a process identifier, a process hash, a file, an object, an application, a service, an Internet Protocol address, a registry key, or a user account.

4. The method of claim 1 , wherein the one or more courses of action includes infrastructure changes to be implemented in the computing network in response to the security incident, and wherein implementing the response strategy includes implementing the infrastructure changes.

5. The method of claim 1 , wherein implementing the response strategy as the automated response includes coordinating operations of one or more third party services.

6. The method of claim 1 , wherein implementing the response strategy as the automated response includes gathering data by the host agent and providing the data to the forensics repository.

7. The method of claim 1 further comprising communicating a notification about the selected response strategy that includes a message that the response strategy has been implemented.

8. The method of claim 7 , wherein the notification about the selected response strategy includes a description of the security incident and a decision prompt, wherein the method further comprises receiving an indication that the response strategy is to be performed, and wherein the response strategy is implemented in response to receiving the indication.

9. The method of claim 8 , wherein the notification about the selected response strategy includes a list of possible courses of action to be performed, wherein receiving the indication includes receiving a selection of one of the courses of action.

10. A system comprising:
one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
receiving, by a threat intelligence device of a computing network and from one or more data feed sources external to the computing network, information related to one or more previously identified computing network security threats;
based at least in part on the information related to the one or more previously identified computing network security threats, determining, by the threat intelligence device, one or more observable indicators of compromise for at least one of the one or more previously identified computing network security threats;
receiving, by a security information and analytics device of the computing network and from the threat intelligence device, the one or more observable indicators of compromise;
continually monitoring, by the security information and analytics device, one or more computing network data sources internal to the computing network for occurrences of security incidents and identifying, by the security information and analytics device, a security incident as an occurrence of a particular computing network security threat from the one or more previously identified computing network security threats, based on detecting one or more of the one or more observable indicators of compromise for the particular computing network security threat;
comparing, by the security and analytics device, the security incident with a predefined ontology that maps the security incident to one or more courses of action, the one or more courses of action including workflow steps to be performed in response to the security incident, and storing results from comparing the security incident with the predefined ontology in a database forming part of the one or more storage devices;
selecting, by the security and analytics device, a response strategy that includes the one or more courses of action by analyzing the results of the comparing stored in the database and providing, by the security and analytics device to an automated incident response device of the computing network, instructions for implementing the response strategy; and
implementing, by the automated incident response device, the response strategy as an automated response including, for each workflow step of the one or more courses of action, performing the workflow step, receiving forensics information related to performing the workflow step from a host agent of the automated incident response device, and providing the forensics information to a forensics repository.

11. The system of claim 10 , wherein the predefined ontology is a runbook ontology that includes a representation of a structure that specifies details for controlling the system.

12. The system of claim 10 , wherein the one or more courses of action includes infrastructure changes to be implemented in the computing network in response to the security incident, and wherein implementing the response strategy includes implementing the infrastructure changes.

13. The system of claim 10 , wherein implementing the response strategy as the automated response includes coordinating

Assignees

• Accenture Global Services Ltd

Inventors

• Carver Matthew
• Divalentin Louis William
• Lefebvre Michael L
• Hovor Elvis
• Rozmiarek David William

Classifications

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L41/0895

  Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements · CPC title

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L41/0816

  the condition being an adaptation, e.g. in response to network events · CPC title