Cyber security sharing and identification system

Patent metadata

Field	Value
Publication number	US-9923925-B2
Application number	US-201514684231-A
Country	US
Kind code	B2
Filing date	Apr 10, 2015
Priority date	Feb 20, 2014
Publication date	Mar 20, 2018
Grant date	Mar 20, 2018

Abstract

Systems and techniques for sharing security data are described herein. Security rules and/or attack data may be automatically shared, investigated, enabled, and/or used by entities. A security rule may be enabled on different entities comprising different computing systems to combat similar security threats and/or attacks. Security rules and/or attack data may be modified to redact sensitive information and/or configured through access controls for sharing.

First claim

What is claimed is:

1. A system for sharing security information, the system comprising:
a plurality of entities, wherein each entity of the plurality of entities comprises a network of computing devices; and
one or more computing devices programmed, via executable code instructions, to:
share a first plurality of security attack data, the first plurality of security attack data comprising information regarding one or more first security attacks;
receive a ruleset from a first entity of the plurality of entities, the ruleset comprising instructions selectably applicable by an entity of the plurality of entities to detect one or more security attacks, wherein the ruleset is generated by the first entity, and wherein the ruleset is associated with the first plurality of security attack data; and
apply the ruleset at a second entity of the plurality of entities to identify malicious behavior of a potential or actual security attack, wherein applying the ruleset comprises:
identifying a plurality of network communications associated with a network of computing devices of the second entity, wherein the plurality of network communications are from the network of computing devices of the second entity to an external computing device;
identifying an elapsed time between at least two communications of the plurality of network communications; and
determining that the elapsed time is within a predetermined time interval, wherein said determination indicates beaconing behavior.

2. The system of claim 1 , wherein the ruleset accesses one or more data objects associated with the second entity, the one or more data objects comprising the plurality of network communications.

3. The system of claim 1 , wherein the one or more computing devices is further programmed, via executable code instructions, to:
provide an alert indicating the potential or actual security attack.

4. The system of claim 3 , wherein the one or more computing devices is further programmed, via executable code instructions, to:
identify a computing device from the network of computing devices of the second entity, wherein the computing device is the source of at least one communication from the plurality of network communications;
identify potentially malicious code on the computing device, wherein the potentially malicious code sent the at least one communication; and
at least one of: removing or quarantining the potentially malicious code.

5. The system of claim 1 , wherein application of the ruleset at the second entity further comprises identifying an external IP address associated with the potential or actual security attack.

6. The system of claim 5 , wherein the one or more computing devices is further programmed, via executable code instructions, to:
block one or more communications from the external IP address to a computing device of the second entity.

7. The system of claim 1 , wherein the one or more computing devices is further programmed, via executable code instructions, to:
access second security attack data associated with a second potential or actual security attack directed at the second entity;
access redaction rules of the second entity, wherein the redaction rules are associated with at least one of: internal IP addresses, hostnames, or other identifying information of a network of computing devices of the second entity;
generate modified security attack data from the second security attack data by removing any matching internal IP addresses, hostnames, or other identifying information as indicated by the redaction rules; and
share the modified security attack data with a third entity.

8. Non-transitory computer storage comprising instructions for causing one or more computing devices to perform operations comprising:
sharing a first plurality of security attack data, the first plurality of security attack data comprising information regarding one or more first security attacks;
receiving a ruleset from a first entity of a plurality of entities, the ruleset comprising instructions selectably applicable by an entity of the plurality of entities to detect one or more security attacks, wherein the ruleset is generated by the first entity, and wherein the ruleset is associated with the first plurality of security attack data, and wherein each entity of the plurality of entities comprises a network of computing devices; and
applying the ruleset at a second entity of the plurality of entities to identify malicious behavior of a potential or actual security attack, wherein applying the ruleset comprises:
identifying a plurality of network communications associated with a network of computing devices of the second entity, wherein the plurality of network communications are from the network of computing devices of the second entity to an external computing device;
identifying an elapsed time between at least two communications of the plurality of network communications; and
determining that the elapsed time is within a predetermined time interval, wherein said determination indicates beaconing behavior.

9. The non-transitory computer storage of claim 8 , wherein the ruleset accesses one or more data objects associated with the second entity, the one or more data objects comprising the plurality of network communications.

10. The non-transitory computer storage of claim 8 , wherein the operations further comprise:
providing an alert indicating the potential or actual security attack.

11. The non-transitory computer storage of claim 10 , wherein the operations further comprise:
accessing second security attack data associated with a second potential or actual security attack directed at the second entity;
accessing redaction rules of the second entity, wherein the redaction rules are associated with at least one of: internal IP addresses, hostnames, or other identifying information of a network of computing devices of the second entity;
generating modified security attack data from the second security attack data by removing any matching internal IP addresses, hostnames, or other identifying information as indicated by the redaction rules; and
sharing the modified security attack data with a third entity.

12. The non-transitory computer storage of claim 8 , wherein applying the ruleset at the second entity further comprises identifying an external IP address associated with the potential or actual security attack.

13. The non-transitory computer storage of claim 12 , wherein the operations further comprise:
blocking one or more communications from the external IP address to a computing device of the second entity.

14. A computer implemented method comprising:
receiving a ruleset at a second entity of a plurality of entities, wherein the ruleset comprises instructions selectably applicable by an entity of the plurality of entities to detect one or more security attacks, wherein the ruleset was generated by a first entity of the plurality of entities, wherein the ruleset is associated with a first plurality of security attack data, and wherein each entity of the plurality of entities comprises a network of computing devices; and
applying the ruleset at the second entity to identify a potential or actual security attack at the second entity, wherein applying the ruleset comprises:
identifying a plurality of network communications associated with a network of computing devices of the second entity, wherein the plurality of network communications are from the network of computing devices of the second entity to an external computing device;
identifying an elapsed time between at least two communications of the plurality of network com

Assignees

• Palantir Technologies Inc

Inventors

• Albertson Jacob
• Hildebrandt Melody
• Singh Harkirat
• Sankar Shyam
• Ducott Rick
• Maag Peter
• Kimball Marissa

Classifications

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title