Systems and methods for predicting security threat attacks

Patent metadata

Field	Value
Publication number	US-9948663-B1
Application number	US-201514974583-A
Country	US
Kind code	B1
Filing date	Dec 18, 2015
Priority date	Dec 7, 2015
Publication date	Apr 17, 2018
Grant date	Apr 17, 2018

Abstract

A computer-implemented method for predicting security threat attacks may include (1) identifying candidate security threat targets with latent attributes that describe features of the candidate security threat targets, (2) identifying historical attack data that describes which of the candidate security threat targets experienced an actual security threat attack, (3) determining a similarity relationship between latent attributes of at least one specific candidate security threat target and latent attributes of the candidate security threat targets that experienced an actual security threat attack according to the historical attack data, (4) predicting, based on the determined similarity relationship, that the specific candidate security threat target will experience a future security threat attack, and (5) performing at least one remedial action to protect the specific candidate security threat target in response to predicting the future security threat attack. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for predicting security threat attacks, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying candidate security threat targets with latent attributes that describe features of the candidate security threat targets;
identifying historical attack data that describes which of the candidate security threat targets experienced an actual security threat attack;
determining, by a software security prediction program, a similarity relationship between latent attributes of at least one specific candidate security threat target and latent attributes of the candidate security threat targets that experienced the actual security threat attack according to the historical attack data by analyzing a matrix that indicates that the actual security threat attack targeted the candidate security threat targets by populating a respective entry of the matrix at each intersection between a vector of the matrix that corresponds to the actual security threat attack and each vector of the matrix that corresponds to the candidate security threat targets that experienced the actual security threat attack;
predicting by the software security prediction program based on the determined similarity relationship, that the specific candidate security threat target will experience a future security threat attack; and
performing, by the software security prediction program, at least one remedial action to protect the specific candidate security threat target in response to predicting the future security threat attack, wherein the candidate security threat targets comprise enterprise organizations that include customers of a vendor of the software security prediction program.

2. The method of claim 1 , wherein the actual security threat attack comprises a malware attack.

3. The method of claim 1 , wherein determining the similarity relationship comprises:
identifying an additional candidate security threat target that experienced a pair of actual security threat attacks; and
determining that the specific candidate security threat target experienced one of the pair of actual security threat attacks.

4. The method of claim 3 , wherein predicting that the specific candidate security threat target will experience the future security threat attack comprises predicting that the specific candidate security threat target will experience the other of the pair of actual security threat attacks.

5. The method of claim 1 , wherein determining the similarity relationship comprises:
identifying an additional candidate security threat target that stored a cluster of benign files and that experienced a same security threat attack as the predicted future security threat attack; and
determining that the specific candidate security threat target also stored the cluster of benign files.

6. The method of claim 1 , wherein the matrix identifies:
the enterprise organizations as corresponding to one of rows and columns of the matrix; and
security threat attacks corresponding to the other of the rows and columns of the matrix.

7. The method of claim 6 , wherein the matrix comprises a sparse matrix.

8. The method of claim 6 , wherein determining the similarity relationship comprises performing a rank factorization of the matrix.

9. The method of claim 8 , wherein performing the rank factorization of the matrix comprises executing a stochastic gradient descent algorithm.

10. The method of claim 1 , wherein:
determining the similarity relationship comprises:
ranking candidate security threat targets in terms of counts of experiencing actual security threat attacks; and
ranking security threat attacks in terms of actually attacking enterprise organizations; and

predicting that the specific candidate security threat target will experience the future security threat attack is based on the rank of the specific candidate security threat target and the rank of the predicted future security threat attack.

11. A system for predicting security threat attacks, the system comprising:
an identification module, stored in memory, that:
identifies candidate security threat targets with latent attributes that describe features of the candidate security threat targets; and
identifies historical attack data that describes which of the candidate security threat targets experienced an actual security threat attack;

a determination module, stored in memory, that determines, as part of a software security prediction program, similarity relationship between latent attributes of at least one specific candidate security threat target and latent attributes of the candidate security threat targets that experienced the actual security threat attack according to the historical attack data by analyzing a matrix that indicates that the actual security threat attack targeted the candidate security threat targets by populating a respective entry of the matrix at each intersection between a vector of the matrix that corresponds to the actual security threat attack and each vector of the matrix that corresponds to the candidate security threat targets that experienced the actual security threat attack;
a prediction module, stored in memory, that predicts, as part of the software security prediction program based on the determined similarity relationship, that the specific candidate security threat target will experience a future security threat attack;
a performance module, stored in memory, that performs, as part of the software security prediction program, at least one remedial action to protect the specific candidate security threat target in response to predicting the future security threat attack, wherein the candidate security threat targets comprise enterprise organizations that include customers of a vendor of the software security prediction program; and
at least one physical processor configured to execute the identification module, the determination module, the prediction module, and the performance module.

12. The system of claim 11 , wherein the actual security threat attack comprises a malware attack.

13. The system of claim 12 , wherein the determination module determines the similarity relationship by:
identifying an additional candidate security threat target that experienced a pair of actual security threat attacks; and
determining that the specific candidate security threat target experienced one of the pair of actual security threat attacks.

14. The system of claim 13 , wherein
the prediction module predicts that the specific candidate security threat target will experience the future security threat attack by predicting that the specific candidate security threat target will experience the other of the pair of actual security threat attacks.

15. The system of claim 11 , wherein the determination module determines the similarity relationship by:
identifying an additional candidate security threat target that stored a cluster of benign files and that experienced a same security threat attack as the predicted future security threat attack; and
determining that the specific candidate security threat target also stored the cluster of benign files.

16. The system of claim 11 , wherein the matrix identifies:
the enterprise organizations as corresponding to one of rows and columns of the matrix; and
security threat attacks corresponding to the other of the rows and columns of the matrix.

17. The system of claim 16 , wherein the matrix comprises a sparse matrix.

18. T

Assignees

• Symantec Corp

Inventors

• Wang Yining
• Gates Christopher
• Roundy Kevin
• Vasiloglou Nikolaos

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06F16/285

  Clustering or classification · CPC title

• G06F16/13

  File access structures, e.g. distributed indices (arrangements of input from, or output to, record carriers G06F3/06) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title