Anomaly detection system for enterprise network security

Patent metadata

Field	Value
Publication number	US-9503469-B2
Application number	US-201514794708-A
Country	US
Kind code	B2
Filing date	Jul 8, 2015
Priority date	Jun 25, 2012
Publication date	Nov 22, 2016
Grant date	Nov 22, 2016

Abstract

Anomaly detection is disclosed, including: determining a set of anomalous events associated with an enterprise network; and determining a path of interest based at least in part on at least a subset of the set of anomalous events.

First claim

What is claimed is:

1. An anomaly detection system, comprising:
a processor configured to:
determine a set of anomalous events associated with an enterprise network, wherein each of the set of anomalous events is stored with a corresponding plurality of attributes;
determine a path of interest based at least in part on at least a subset of the set of anomalous events, wherein the path of interest includes a series of two or more anomalous events from the set of anomalous events, wherein each anomalous event of the path of interest is determined to be linked to an adjacent anomalous event of the path of interest based at least in part on a shared attribute that the anomalous event shares with the adjacent anomalous event;
assign to each link associated with adjacent anomalous events comprising the path of interest a link score for that link; and
determine an overall score corresponding to the path of interest based at least in part on respective link scores of one or more links comprising the path of interest; and

a memory coupled to the processor and configured to store data associated with the set of anomalous events.

2. The system of claim 1 , wherein one of the set of anomalous events includes an incident suspected as being associated with a security threat.

3. The system of claim 1 , wherein the processor is further configured to collect a plurality of security patterns and determine one or more features for one of the plurality of security patterns.

4. The system of claim 1 , wherein the processor is further configured to:
build a plurality of sensors, wherein one of the plurality of sensors comprises a model trained on historical event data; and
use the plurality of sensors to determine at least the set of anomalous events based at least in part on current event data.

5. The system of claim 4 , wherein the sensor is configured to determine that an event is anomalous based on a threshold score predefined for the sensor.

6. The system of claim 1 , wherein to determine the path of interest includes to use link analysis to determine a link between pairs of anomalous events included in the set of anomalous events.

7. The system of claim 1 , wherein a link score associated with a link between a first anomalous event and a second anomalous event comprising the path of interest is determined based at least in part on at least some of the stored plurality of attributes corresponding to the first anomalous event and at least some of the stored plurality of attributes corresponding to the second anomalous event.

8. A method for anomaly detection, comprising:
determining, by a processor, a set of anomalous events associated with an enterprise network, wherein each of the set of anomalous events is stored with a corresponding plurality of attributes;
determining a path of interest based at least in part on at least a subset of the set of anomalous events, wherein the path of interest includes a series of two or more anomalous events from the set of anomalous events, wherein each anomalous event of the path of interest is determined to be linked to an adjacent anomalous event of the path of interest based at least in part on a shared attribute that the anomalous event shares with the adjacent anomalous event;
assigning to each link associated with adjacent anomalous events comprising the path of interest a link score for that link; and
determining an overall score corresponding to the path of interest based at least in part on respective link scores of one or more links comprising the path of interest.

9. The method of claim 8 , wherein one of the set of anomalous events includes an incident suspected as being associated with a security threat.

10. The method of claim 8 , further comprising collecting a plurality of security patterns and determining one or more features for one of the plurality of security patterns.

11. The method of claim 8 , further comprising:
building a plurality of sensors, wherein one of the plurality of sensors comprises a model trained on historical event data; and
using the plurality of sensors to determine at least the set of anomalous events based at least in part on current event data.

12. The method of claim 11 , wherein the sensor is configured to determine that an event is anomalous based on a threshold score predefined for the sensor.

13. The method of claim 8 , wherein determining the path of interest includes using link analysis to determine a link between pairs of anomalous events included in the set of anomalous events.

14. The method of claim 8 , wherein a link score associated with a link between a first anomalous event and a second anomalous event comprising the path of interest is determined based at least in part on at least some of the stored plurality of attributes corresponding to the first anomalous event and at least some of the stored plurality of attributes corresponding to the second anomalous event.

15. A computer program product for anomaly detection, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
determining a set of anomalous events associated with an enterprise network, wherein each of the set of anomalous events is stored with a corresponding plurality of attributes;
determining a path of interest based at least in part on at least a subset of the set of anomalous events, wherein the path of interest includes a series of two or more anomalous events from the set of anomalous events, wherein each anomalous event of the path of interest is determined to be linked to an adjacent anomalous event of the path of interest based at least in part on a shared attribute that the anomalous event shares with the adjacent anomalous event;
assigning to each link associated with adjacent anomalous events comprising the path of interest a link score for that link; and
determining an overall score corresponding to the path of interest based at least in part on respective link scores of one or more links comprising the path of interest.

16. The computer program product of claim 15 , wherein one of the set of anomalous events includes an incident suspected as being associated with a security threat.

17. The computer program product of claim 15 , further comprising computer instructions for:
building a plurality of sensors, wherein one of the plurality of sensors comprises a model trained on historical event data; and
using the plurality of sensors to determine at least the set of anomalous events based at least in part on current event data.

18. The computer program product of claim 17 , wherein the sensor is configured to determine that an event is anomalous based on a threshold score predefined for the sensor.

19. The computer program product of claim 15 , wherein determining the path of interest includes using link analysis to determine a link between pairs of anomalous events included in the set of anomalous events.

20. The computer program product of claim 15 , wherein link score associated with a link between a first anomalous event and a second anomalous event comprising the path of interest is determined based at least in part on at least some of the stored plurality of attributes corresponding to the first anomalous event and at least some of the stored plurality of attributes corresponding to the second anomalous event.

Assignees

• Emc Corp

Inventors

• Lin Derek

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title