Global clustering of incidents based on malware similarity and online trustfulness

Patent metadata

Field	Value
Publication number	US-9888020-B2
Application number	US-201615231118-A
Country	US
Kind code	B2
Filing date	Aug 8, 2016
Priority date	Feb 3, 2015
Publication date	Feb 6, 2018
Grant date	Feb 6, 2018

Abstract

In an embodiment, a method, performed by processors of a computing device for creating and storing clusters of incident data records based on behavioral characteristic values in the records and origin characteristic values in the records, the method comprising: receiving a plurality of input incident data records comprising sets of attribute values; identifying two or more first incident data records that have a particular behavioral characteristic value; using a malicious incident behavioral data table that maps sets of behavioral characteristic values to identifiers of malicious acts in the network, and a plurality of comparison operations using the malicious incident behavioral data table and the two or more first incident data records, determining whether any of the two or more first incident data records are malicious; and if so, creating a similarity behavioral cluster record that includes the two or more first incident data records.

First claim

What is claimed is:

1. A data processing method, performed by one or more processors of a computing device, for creating and storing clusters of incident data records based on behavioral characteristic values in the incident data records and origin characteristic values in the incident data records, the method comprising:
receiving a plurality of input incident data records comprising sets of computer network attribute values determined based upon a plurality of incidents that have occurred in one or more computer networks;
wherein an incident data record of the plurality of input incident data records comprises at least one or more behavioral characteristic values;
identifying two or more first incident data records, of the plurality of input incident data records, that have a particular behavioral characteristic value of the one or more behavioral characteristics values;
determining whether any of the two or more first incident data records has been identified as malicious;
in response to determining that a first incident data record, from the two or more first incident data records, has been identified as malicious, creating and storing in a computer memory a similarity behavioral cluster record that includes the two or more first incident data records.

2. The data processing method of claim 1 ,
wherein the incident data record of the plurality of input incident data records further comprises a severity level value and a confidence score value;
wherein the two or more first incident data records are of the plurality of input incident data records have the particular behavioral characteristics value of the one or more behavioral characteristics values stored in all of the two or more first incident data records.

3. The data processing method of claim 2 , further comprising:
in response to determining that the first incident data record, from the two or more first incident data records, has been identified as malicious:
modifying severity level values that are stored in each of the two or more first incident data records by increasing the severity level values by a first value;
modifying confidence score values that are stored in each of the two or more first incident data records by increasing the confidence score values by a second value;

determining whether any of the two or more first incident data records has been identified as malicious based on: a malicious incident behavioral data table stored in a data storage device that maps sets of behavioral characteristic values to identifiers of malicious acts in the one or more computer networks, and based on a plurality of comparison operations using the malicious incident behavioral data table and the two or more first incident data records.

4. The data processing method of claim 3 , further comprising: modifying the severity level values for each of the two or more first incident data records that are included in the similarity behavioral cluster record based on a severity or a trustfulness associated to the similarity behavioral cluster record.

5. The data processing method of claim 3 , wherein the particular behavioral characteristic value is one or more of: data tunneling data, data indicating contacting randomly generated domains, data indicating verifying connections, data indicating issuing periodical polling requests, data indicating tunneling through certain domains and nodes, or data indicating downloading executable files.

6. The data processing method of claim 3 , further comprising: determining the similarity behavioral cluster record that has a severity level value by determining an average value of the severity level values of incidents that are included in the similarity behavioral cluster record;
wherein the severity level value of the incident indicates a maliciousness severity of the incident;
wherein the confidence score of the incident indicates how close the incident is to a corresponding classified behavior.

7. The data processing method of claim 3 , wherein the confidence scores for each of the two or more first incident data records in the similarity behavioral cluster are modified based on one or more of: a size of the similarity behavioral cluster, a count of confirmed infected users, a count of confirmed malicious domains, or whether the similarity behavioral cluster has been verified to be malicious;
wherein each of the confidence scores has a value between 0% and 100%;
wherein the value of 100% indicates that incidents included in the similarity behavioral cluster record are confirmed malware incidents.

8. The data processing method of claim 3 , wherein the incident data record of the plurality of input incident data records further comprises an origin characteristic value of an originator of an incident, and wherein the method further comprises:
identifying two or more second incident data records of the plurality of input incident record data, that have a particular origin characteristic value stored in all of the two or more second incident data records;
using a malicious incident origin data table stored in the data storage device that maps sets of origin characteristic values to identifiers of malicious incident origins, and the plurality of comparison operations using the malicious incident origin data table and the two or more second incident data records, determining whether any of the two or more second incident data records has been identified as malicious;
in response to determining that a second incident data record, from the two or more second incident data records, has been identified as malicious:
creating and storing in the computer memory a trustfulness cluster record that includes the two or more second incident data records;
modifying severity level values that are stored in each of the two or more second incident data records by increasing the severity level values by a third value;
modifying confidence scores that are stored in each of the two or more second incident data records by increasing the confidence score values by a fourth value;
determining a trustfulness level value for the trustfulness cluster record.

9. The data processing method of claim 8 , wherein each incident data record, from the plurality of input incident data records, is initially assigned an initial severity level value and an initial confidence score.

10. The data processing method of claim 8 , wherein the particular origin characteristic value is one or more of: a network domain identifier, a network domain name, an IP address of a device, an IP address of a group of devices, an email address of a user, or an IP address of a user device.

11. A device comprising:
a memory unit;
one or more processors of a computing device configured as a server, configured to perform instructions stored in the memory unit, for creating and storing clusters of incident data records based on behavioral characteristic values in the incident data records and origin characteristic values in the incident data records, wherein execution of the instructions by the processors causes:
receiving a plurality of input incident data records comprising sets of computer network attribute values determined based upon a plurality of incidents that have occurred in one or more computer networks;
wherein an incident data record of the plurality of input incident data records comprises at least one or more behavioral characteristic values;
identifying two or more first incident data records, of the plurality of input incident data records, that have a particular behavioral characteristic value of the one or more behavioral characteristics values;
determining whether any of the two or more first incident data records has been ide

Assignees

• Cisco Tech Inc

Inventors

• Bartos Karel
• Rehak Martin
• Sofka Michal

Classifications

• G06F16/285

  Clustering or classification · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/55 Primary

  Detecting local intrusion or implementing counter-measures · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title