Systems and methods for anomaly detection based on endpoint and network traffic profiles
Systems and methods for anomaly detection based on endpoint and network traffic profiles include performing inline monitoring of traffic within a network of a plurality of networks via a cloud; identifying anomalous traffic within the traffic based on a network profile, wherein the network profile defines baseline network traffic parameters for the network; determining if one or more other networks of the plurality of networks exhibit traffic similar to the anomalous traffic; and performing an action based on the determining.
1 . A method comprising steps of:
performing, by a cloud-based security service operating as an inline overlay between endpoints of the network and an external network, inline monitoring of traffic within a network of a plurality of networks via a cloud;
storing, for each respective network of the plurality of networks, a corresponding network profile that defines baseline network traffic parameters for the respective network;
identifying anomalous traffic within the traffic based on a network profile, wherein the network profile defines baseline network traffic parameters for the network and wherein the identifying is performed by an analyzer associated with the network;
responsive to identifying the anomalous traffic, transmitting, by the analyzer to the cloud, an alert that includes one or more parameter ted with the anomalous traffic;
determining, responsive to receiving the alert, by a macro controller of the cloud, if one or more other networks of the plurality of networks exhibit traffic similar to the anomalous traffic by comparing the one or more parameters associated with the anomalous traffic to (i) one or more network profiles corresponding to the one or more other networks and (ii) one or more ale received from analyzers associated with the one or more other networks; and
performing an action based on the determining, wherein the action includes any of allowing the traffic, blocking the traffic, and alerting a user of the network and wherein the action is performed by the analyzer or the cloud-based security service.
2 . The method of claim 1 , wherein determining whether the one or more other networks exhibit traffic similar to the anomalous traffic comprises determining whether the one or more parameters match corresponding parameters in the one or more network profiles of the one or more other networks or in one or more alerts previously received from analyzers associated with the one or more other networks.
3 . The method of claim 1 , wherein the identifying is performed by an analyzer associated with the network, and wherein the determining is performed by the cloud.
4 . The method of claim 3 , wherein the steps further comprise:
responsive to the analyzer identifying anomalous traffic within the network, receiving an alert for the anomalous traffic; and
responsive to receiving the alert, determining if the one or more other networks of the plurality of networks exhibit traffic similar to the anomalous traffic.
5 . The method of claim 4 , wherein the alert includes one or more parameters associated with the anomalous traffic.
6 . The method of claim 1 , wherein the network profile includes parameters defining baseline characteristics of the network, and wherein identifying anomalous traffic includes detecting parameters within the traffic which fall outside of the baseline characteristics of the network.
7 . The method of claim 1 , wherein the determining includes determining that one or more other networks of the plurality of networks exhibit traffic similar to the anomalous traffic, and wherein the action includes allowing the traffic based thereon.
8 . The method of claim 7 , wherein the one or more other networks of the plurality of networks belong to any of a same customer associated with the network and one or more different customers.
9 . The method of claim 7 , wherein the steps further comprise:
updating the network profile based on determining that one or more other networks of the plurality of networks exhibit traffic similar to the anomalous traffic.
10 . The method of claim 1 , wherein the determining includes determining that one or more other networks of the plurality of networks do not exhibit traffic similar to the anomalous traffic, and wherein the steps further comprise:
performing an inspection of the anomalous traffic to determine if the anomalous traffic is malicious.
11 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
performing, by a cloud-based security service operating as an inline overlay between endpoints of the network and an external network, inline monitoring of traffic within a network of a plurality of networks via a cloud;
storing, for each respective network of the plurality of networks, a corresponding network profile that defines baseline network traffic parameters for the respective network;
identifying anomalous traffic within the traffic based on a network profile, wherein the network profile defines baseline network traffic parameters for the network and wherein the identifying is performed by an analyzer associated with the network;
responsive to identifying the anomalous traffic, transmitting, by the analyzer to the cloud, an alert that includes one or more associated with the anomalous traffic;
determining, responsive to receiving the alert, by a macro controller of the cloud, if one or more other networks of the plurality of networks exhibit traffic similar to the anomalous traffic by comparing the one or more parameters associated with the anomalous traffic to (i) one or more network profiles corresponding to the one or more other networks and (ii) one or more alerts received from analyzers associated with the one or more other networks; and
performing an action based on the determining, wherein the action includes any of allowing the traffic, blocking the traffic, and alerting a user of the network and wherein the action is performed by the analyzer or the cloud-based security service.
12 . The non-transitory computer-readable medium of claim 11 , wherein determining whether the one or more other networks exhibit traffic similar to the anomalous traffic comprises determining whether the one or more parameters match corresponding parameters in the one or more network profiles of the one or more other networks or in one or more alerts previously received from analyzers associated with the one or more other networks.
13 . The non-transitory computer-readable medium of claim 11 , wherein the identifying is performed by an analyzer associated with the network, and wherein the determining is performed by the cloud.
14 . The non-transitory computer-readable medium of claim 13 , wherein the steps further comprise:
responsive to the analyzer identifying anomalous traffic within the network, receiving an alert for the anomalous traffic; and
responsive to receiving the alert, determining if the one or more other networks of the plurality of networks exhibit traffic similar to the anomalous traffic.
15 . The non-transitory computer-readable medium of claim 14 , wherein the alert includes one or more parameters associated with the anomalous traffic.
16 . The non-transitory computer-readable medium of claim 11 , wherein the network profile includes parameters defining baseline characteristics of the network, and wherein identifying anomalous traffic includes detecting parameters within the traffic which fall outside of the baseline characteristics of the network.
17 . The non-transitory computer-readable medium of claim 11 , wherein the determining includes determining that one or more other networks of the plurality of networks exhibit traffic similar to the anomalous traffic, and wherein the action includes allowing the traffic based thereon.
18 . The non-transitory computer-readable medium of claim 17 , wherein the one or more other networks of the plurality of networks belong to any of a same customer associated with the network and one or more different customers.
19 . The non-transitory computer-readable medium of claim 17 , wherein the steps further comprise:
updating the network profile based on determining that one or more other networks of the plurality of networks exhibit traffic similar to the anomalous traffic.
20 . The non-transitory computer-readable medium of claim 11 , wherein the determining includes determining that one or more other networks of the plurality of networks do not exhibit traffic similar to the anomalous traffic, and wherein the steps further comprise:
performing an inspection of the anomalous traffic to determine if the anomalous traffic is malicious.