Pattern discovery in a network security system
View Patent ↗Patterns can be discovered in security events collected by a network security system. In one embodiment, the present invention includes collecting and storing security events from a variety of monitor devices. In one embodiment, a subset of the stored security events is provided to a manager as an event stream. In one embodiment, the present invention further includes the manager discovering one or more previously unknown event patterns in the event stream.
1. A method for discovering an event pattern in an event stream, the event stream comprising a plurality of security events, the method comprising:
creating a plurality of transactions based on a transaction parameter, wherein each transaction represents a subset of the plurality of security events;
generating a transaction tree based on the plurality of transactions, wherein the transaction tree includes one root node and a plurality of non-root nodes, and wherein each non-root node represents a security event;
extracting the event pattern from the transaction tree, which comprises:
traversing a branch of the transaction tree starting at the root node, wherein the branch extends from the root node through a first non-root node to a second non-root node;
observing a drop in support from the first non-root node to the second non-root node, wherein a support of a non-root node represents a number of transactions that include the security event represented by the non-root node; and
determining that the event pattern includes the security event represented by the first non-root node and does not include the security event represented by the second non-root node; and
storing the event pattern.
2. The method of claim 1 , wherein the transaction parameter comprises an interval of time, and wherein each transaction represents events that were received during the interval of time.
3. The method of claim 1 , wherein the transaction parameter comprises a value of an event field, and wherein each transaction represents events that include the value of the event field.
4. The method of claim 3 , wherein the event field comprises a source address.
5. The method of claim 3 , wherein the event field comprises a destination address.
6. The method of claim 1 , wherein the transaction parameter comprises a point in time, and wherein each transaction represents events that were received proximate to the point in time.
7. The method of claim 1 , wherein generating the transaction tree based on the plurality of transactions comprises generating the transaction tree based on a support of a security event within the plurality of transactions.
8. The method of claim 1 , further comprising providing a user an option to convert the event pattern into an event correlation rule.
9. The method of claim 1 , further comprising creating an event correlation rule using the event pattern.
10. The method of claim 1 , wherein the plurality of events had been stored in an event database.
11. The method of claim 1 , further comprising removing a field from each event in the plurality of security events.
12. The method of claim 11 , wherein a value of the field is unique to each event.
13. A method for generating a rule, comprising:
displaying a pattern discovery tool configured to enable a user to select a subset of previously stored security events;
in response to the user selection:
creating a plurality of transactions based on a transaction parameter, wherein each transaction represents a subset of the selected security events;
generating a transaction tree based on the plurality of transactions, wherein the transaction tree includes one root node and a plurality of non-root nodes, and wherein each non-root node represents a security event; and
extracting an event pattern from the transaction tree, which comprises:
traversing a branch of the transaction tree starting at the root node, wherein the branch extends from the root node through a first non-root node to a second non-root node;
observing a drop in support from the first non-root node to the second non-root node, wherein a support of a non-root node represents a number of transactions that include the security event represented by the non-root node; and
determining that the event pattern includes the security event represented by the first non-root node and does not include the security event represented by the second non-root node;
displaying a rule generation tool configured to enable a user to perform an action; and
in response to the user action:
converting a selected newly identified event pattern into a correlation rule.
14. The method of claim 13 , wherein the user action comprises a single mouse-click.
15. A system for discovering an event pattern in an event stream, the event stream comprising a plurality of security events, the system comprising a processor configured to execute a method, the method comprising:
creating a plurality of transactions based on a transaction parameter, wherein each transaction represents a subset of the plurality of security events;
generating a transaction tree based on the plurality of transactions, wherein the transaction tree includes one root node and a plurality of non-root nodes, and wherein each non-root node represents a security event; and
extracting the event pattern from the transaction tree, which comprises:
traversing a branch of the transaction tree starting at the root node, wherein the branch extends from the root node through a first non-root node to a second non-root node;
observing a drop in support from the first non-root node to the second non-root node, wherein a support of a non-root node represents a number of transactions that include the security event represented by the non-root node; and
determining that the event pattern includes the security event represented by the first non-root node and does not include the security event represented by the second non-root node.
16. The system of claim 15 , wherein the transaction parameter comprises an interval of time, and wherein each transaction represents events that were received during the interval of time.
17. The system of claim 15 , wherein the transaction parameter comprises a value of an event field, and wherein each transaction represents events that include the value of the event field.
18. The system of claim 15 , wherein the transaction parameter comprises a point in time, and wherein each transaction represents events that were received proximate to the point in time.
19. The system of claim 15 , wherein generating the transaction tree based on the plurality of transactions comprises generating the transaction tree based on a support of a security event within the plurality of transactions.
20. The system of claim 15 , wherein the method further comprises displaying a user interface to provide a user a tool to convert the event pattern into an event correlation rule.
21. The system of claim 15 , wherein the method further comprises removing a field from each event in the plurality of security events.
22. A machine-readable storage medium having stored thereon data representing instructions that, when executed by a processor, cause the processor to perform operations comprising:
creating a plurality of transactions based on a transaction parameter, wherein each transaction represents a subset of a plurality of security events;
generating a transaction tree based on the plurality of transactions, wherein the transaction tree includes one root node and a plurality of non-root nodes, and wherein each non-root node represents a security event; and
extracting an event pattern from the transaction tree, which comprises:
traversing a branch of the transaction tree starting at the root node, wherein the branch extends from the root node through a first non-root node to a second non-root node;
observing a drop in support from the first non-root node to the second non-root node, wherein a support of a non-root node represents a number of transactions that include the security event represented by the non-root node; and
determining that the event pattern includes the security event represented by the first non-root node and does not include the security event represented by the second non-root node.
23. The machine-readable medium of claim 22 , wherein generating the transaction tree based on the plurality of transactions comprises generating the transaction tree based on a support of a security event within the plurality of transactions.
24. The machine-readable medium of claim 22 , wherein the operations further comprise providing a user an option to convert the event pattern into an event correlation rule.
25. The machine-readable medium of claim 22 , wherein the operations further comprise creating an event correlation rule using the event pattern.
26. The machine-readable medium of claim 22 , wherein the operations further comprise removing a field from each event in the plurality of security events.