Profiling brute force cyberattacks
Various embodiments include systems and methods to implement profiling of cyberattacks, where the profiling is performed by a security platform. Profiling of cyberattacks may be performed by determining sets of access attempts that are associated with one or more cyberattacks, where the sets of access attempts are used to profile subsequent access attempts. The security platform may determine whether a given set of access attempts is similar to previous sets of access attempts determined to be cyberattacks using various techniques, including set similarity, set overlap coefficients, or equality of hash data associated with different sets of access attempts.
1 . A method comprising:
determining, with respect to a first network device, a first set of access attempts, wherein the first network device is associated with detecting unauthorized access to a computing resource;
determining, with respect to a second network device, a second set of access attempts associated with the computing resource;
determining a measure of similarity between the first set of access attempts and the second set of access attempts, wherein the measure of similarity is calculated based on (a) an intersection of the first set of access attempts and the second set of access attempts and (b) a union of the first set of access attempts and the second set of access attempts;
determining, based on the measure of similarity being greater than or equal to a similarity threshold, that the second set of access attempts is part of a brute force cyberattack attempting to access the computing resource and that the brute force cyberattack matches a threat actor profile associated with a threat actor; and
determining, based on a hash function applied to the first set of access attempts, first hash data and based on the hash function applied to the second set of access attempts, second hash data, wherein based on the first hash data not being equal to the second hash data:
determining, based on the intersection of the first set of access attempts and the second set of access attempts, a third set of access attempts, and
determining, based on the union of the first set of access attempts and the second set of access attempts, a fourth set of access attempts, wherein the measure of similarity being greater than the similarity threshold is based on a ratio of a size of the third set of access attempts and a size of the fourth set of access attempts.
2 . The method of claim 1 , wherein
the first network device is configured to interact with threat actors, and wherein the first network device is isolated from other network devices of a client network.
3 . The method of claim 1 , further comprising:
determining, over a period of time and with respect to the first network device, a plurality of access attempts; and
determining one or more time-based clusters of access attempts;
wherein the first set of access attempts comprises a time-based cluster of access attempts from among the one or more time-based clusters of access attempts.
4 . The method of claim 1 , wherein, based on the first hash data being equal to the second hash data:
the measure of similarity is indicative of the first set of access attempts being equal to the second set of access attempts.
5 . The method of claim 1 , further comprising:
determining subset data indicative of (i) the first set of access attempts being a subset of the second set of access attempts or of (ii) the second set of access attempts being a subset of the first set of access attempts;
wherein the measure of similarity being greater than the similarity threshold is based on the subset data.
6 . A system comprising:
a memory storing executable instructions; and
one or more processors that execute the executable instructions to:
determine, with respect to a first network device, a first set of access attempts, wherein the first network device is associated with
detecting unauthorized access to a computing resource; determine, with respect to a second network device, a second set of access attempts associated with the computing resource;
determine a measure of similarity between the first set of access attempts and the second set of access attempts, wherein the measure of similarity is calculated based on (a) an intersection of the first set of access attempts and the second set of access attempts and (b) a union of the first set of access attempts and the second set of access attempts;
determine, based on the measure of similarity being greater than or equal to a similarity threshold, that the second set of access attempts is part of a brute force cyberattack attempting to access the computing resource and that the brute force cyberattack matches a threat actor profile associated with a threat actor; and
determine, based on a hash function applied to the first set of access attempts, first hash data and based on the hash function applied to the second set of access attempts, second hash data, wherein based on the first hash data not being equal to the second hash data:
determine, based on the intersection of the first set of access attempts and the second set of access attempts, a third set of access attempts, and
determine, based on the union of the first set of access attempts and the second set of access attempts, a fourth set of access attempts, wherein the measure of similarity being greater than the similarity threshold is based on a ratio of a size of the third set of access attempts and a size of the fourth set of access attempts.
7 . The system of claim 6 , wherein
the first network device is configured to interact with a security threat, and wherein the first network device is isolated from other network devices of a client network.
8 . The system of claim 6 , wherein the one or more processors further execute the executable instructions to:
determine, over a period of time and with respect to the first network device, a plurality of access attempts; and
determine one or more time-based clusters of access attempts;
wherein the first set of access attempts comprises a time-based cluster of access attempts from among the one or more time-based clusters of access attempts.
9 . The system of claim 6 , wherein, based on the first hash data being equal to the second hash data, the one or more processors further execute the executable instructions to:
the measure of similarity is indicative of the first set of access attempts being equal to the second set of access attempts.
10 . The system of claim 6 , wherein the one or more processors further execute the executable instructions to:
determine subset data indicative of (i) the first set of access attempts being a subset of the second set of access attempts or of (ii) the second set of access attempts being a subset of the first set of access attempts;
wherein the measure of similarity being greater than the similarity threshold is based on the subset data.
11 . One or more non-transitory computer-accessible storage media storing executable instructions that, when executed by one or more processors, cause a computer system to:
determine, with respect to a first network device, a first set of access attempts, wherein the first network device is associated with detecting unauthorized access to a computing resource;
determine, with respect to a second network device, a second set of access attempts associated with the computing resource, wherein the measure of similarity is calculated based on (a) an intersection of the first set of access attempts and the second set of access attempts and (b) a union of the first set of access attempts and the second set of access attempts;
determine a measure of similarity between the first set of access attempts and the second set of access attempts; and
determine, based on the measure of similarity being greater than or equal to a similarity threshold, that the second set of access attempts is part of a brute force cyberattack attempting to access the computing resource and that the brute force cyberattack matches a threat actor profile associated with a threat actor;
determine, based on the intersection of the first set of access attempts and the second set of access attempts, a third set of access attempts; and
determine, based on the union of the first set of access attempts and the second set of access attempts, a fourth set of access attempts, wherein the measure of similarity being greater than the similarity threshold is based on a ratio of a size of the third set of access attempts and a size of the fourth set of access attempts.
12 . The non-transitory computer-accessible storage media of claim 11 , wherein the first network device is configured to interact with a security threat, and wherein the first network device is isolated from other network devices of a client network.
13 . The non-transitory computer-accessible storage media of claim 11 , wherein the executable instructions when executed by the one or more processors cause the computer system to:
determine, over a period of time and with respect to the first network device, a plurality of access attempts; and
determine one or more time-based clusters of access attempts;
wherein the first set of access attempts comprises a time-based cluster of access attempts from among the one or more time-based clusters of access attempts.
14 . The non-transitory computer-accessible storage media of claim 11 , wherein the executable instructions when executed by the one or more processors cause the computer system to:
determine, based on a hash function applied to the first set of access attempts, first hash data; and
determine, based on the hash function applied to the second set of access attempts, second hash data,
wherein the measure of similarity is based on the first set of access attempts being equal to the second set of access attempts and first hash data being equal to the second hash data.
15 . The non-transitory computer-accessible storage media of claim 14 , wherein the matching of the second set of access attempts to the threat actor profile is based on comparison of the second hash data to multiple hash data values stored in a database.