Context-aware compromise assessment

Patent metadata

Field	Value
Publication number	US-9736182-B1
Application number	US-201414282098-A
Country	US
Kind code	B1
Filing date	May 20, 2014
Priority date	May 20, 2014
Publication date	Aug 15, 2017
Grant date	Aug 15, 2017

Abstract

Assessing compromises of data security is achieved by establishing access control policies for data files in storage devices across an enterprise. A list is compiled of the data files that were accessed by processes executing on processors of the enterprise. A suspicion score is assigned to each of the processes based on deviations of in-memory behaviors of the processes from established criteria. In response to the suspicion score meeting a suspicious process criterion, the file system operations performed by the suspicious process are analyzed against the access control policies and the suspicion score is modified based on a degree to which the file system operations performed by the suspicious process violate the access control policies.

First claim

What is claimed is:

1. A method for assessing compromises of data security, the method comprising:
establishing access control policies for data files stored in storage devices across a communication network of an enterprise:
monitoring processes executing on respective processors of the enterprise for file system operations performed thereby:
assigning a suspicion score to each of the processes based on a degree to which in-memory behavior of the process deviates from previously established criteria;
analyzing, in response to the suspicion score assigned to any of the processes meeting a suspicious process criterion, file system operations performed by the suspicious process against the access control policies;
modifying the suspicion score based on a degree to which the file system operations performed by the suspicious process violate the access control policies;
monitoring each process executing on each processor for data transport operations performed thereby in addition to the monitoring of the file system operations;
storing attributes of each of the file system operations and each of the data transport operations in respective graph node data structures;
identifying one or more correlations, each of the one or more correlations correlating one or more of the file system operations with one or more of the data transport operations for a given one of the processes;
storing attributes of the one or more correlations in graph edge data structures;
generating a process-network-file (PNF) graph data structure in which the graph node data structures representing the file system operations and the data transport operations are logically connected one to another through corresponding graph edge data structures representing the one or more correlations; and
rendering a representation of the PNF graph data structure on a display such that graphical representations of the graph node data structures are graphically linked by graphical representations of the graph edge data structures;
wherein the attributes of a given one of the one or more correlations stored in the graph edge data structures include a weight indicating the given correlation, and rendering the representation of the PNF graph data structure includes indicating the weight in the graphical representation of the graph edge data structures for the given correlation;
wherein the PNF graph data structure comprises, for the given correlation:
at least one source node corresponding to one or more of the graph node data structures, the source node representing at least one of a source file and a source network connection for the given process;
at least one destination node corresponding to one or more of the graph node data structures, the destination node representing at least one of a destination file and a destination network connection for the given process;
at least one operator node corresponding to one or more of the graph node data structures, the operator node representing at least one of the given process and a user associated with the given process; and
at least one edge node corresponding to one or more of the graph edge data structures, the edge node representing relationships between the at least one source node, the at least one destination node and the at least one operator node; and

wherein the at least one edge node depicts the weight, which is an indication of a level of suspicious behavior associated with at least one of one or more of the file system operations and one or more of the data transport operations represented by the source node, the destination node and the operator node.

2. The method of claim 1 , wherein the access control policies include specifications of business-sensitive content contained in the data files, and analyzing the file system operations comprises analyzing the content of the data files accessed through the file system operations against the specifications of the business-sensitive content.

3. The method of claim 1 , further comprising:
storing identifiers of the data files in an access list for each of the processes executing on each of the processors: and
purging the stored identifiers in accordance with a predetermined moving time window.

4. The method of claim 1 , wherein at least one of the file system operations comprises at least one of a read and a write directed to one or more of the data files stored in one or more of the storage devices.

5. The method of claim 1 , wherein at least one of the data transport operations comprises at least one of sending and receiving one or more of the data files over at least one network.

6. The method of claim 1 , wherein the at least one source node comprises a file node representing the source file, and wherein the representation of the PNF graph data structure is configured to be traversed to utilize the file node to determine from where the source file was copied or transformed by the given process.

7. The method of claim 1 , wherein the at least one destination node comprises a file node representing the destination file, and wherein the representation of the PNF graph data structure is configured to be traversed to utilize the file node to determine how the destination file was created.

8. The method of claim 1 , wherein the at least one source node comprises a network node representing the source network connection, and wherein the representation of the PNF graph data structure is configured to be traversed to utilize the network node to determine whether malicious content was downloaded to a destination address identified in the source node.

9. The method of claim 1 , wherein the at least one destination node comprises a network node representing the destination network connection, and wherein the representation of the PNF graph data structure is configured to be traversed to utilize the network node to determine whether the given process uploaded sensitive content.

10. The method of claim 1 , wherein a given one of the access control policies comprises one or more regular expressions identifying at least one of one or more categories of data and one or more terms that correspond to business-sensitive content in the data files.

11. The method of claim 1 , wherein a given one of the access control policies comprises one or more identities of designated portions of a file hierarchy, one or more user permissions and descriptive data of what is considered business-sensitive content in the data files.

12. An apparatus for assessing compromises of data security, the method apparatus comprising:
a data security system configured to:
establish access control policies for data files stored in storage devices across a communication network of an enterprise;
compile a list of the data files accessed by processes executing on processors of the enterprise; and
assign a suspicion score to each of the processes based on a degree to which in-memory behaviors of the respective processes deviate from previously established criteria; and a context-aware compromise assessment processor (CACAP) configured to:
analyze, in response to the suspicion score assigned to any of the processes meeting a suspicious process criterion, file system operations performed by the suspicious process against the access control policies; and
modify the suspicion score based on a degree to which the file system operations performed by the suspicious process violate the access control policies;

wherein the data security system monitors each of the processes executing on the processors for data transport operations performed thereby in addition to the monitoring of the file system operations, and the CACAP is further configured to:
store attr

Assignees

• Emc Ip Holding Co Llc

Inventors

• Madhukar Anadi
• Pedasingu Vishnu Chaitanya
• Damodara Pisharady Renjith

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/102

  Entity profiles · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title