Automated security analytics platform with pluggable data collection and analysis modules
View Patent ↗Pluggable network security modules provide a collaborative response across plural networks by allowing modules associated with detection and neutralization of a network security threat to plug into a network security platform of other networks. Plugging the security modules in provides an automated insertion of detection and neutralization tools into the network security platform to respond to potential threats based upon proven successful responses at other networks.
1. A method for maintaining network security, the method comprising:
distributing a network security platform to each of plural networks, each network security platform having a sensor execution environment and an analysis execution environment;
monitoring network activity for each of the plural networks with plural sensor modules running on the sensor execution environment of each of the plural network security platforms, the plural sensor modules storing monitored network activity in random access memory accessible by the analysis execution environment, the storing performed by a rowcreate events in one or more tables of the analysis execution environment;
detecting a network threat with one or more of plural analysis modules running on the analysis execution environment of one of the network security platforms, the analysis modules having access to the one or more of tables, each table having plural rows, the analysis modules further having one or more bindings, each binding having at least one handler associated with at least one table for responding to predetermined network activity indicated by a binding of the analysis module to the one or more tables, the sensor module providing a monitored network activity to the one or more tables, the detecting performed by analysis of the stored monitored network activity at the one network security platform, the analysis initiated by one or more of the rowcreate events, wherein one or more of the bindings of the one or more analysis modules to the one or more of the rowcreate events invokes the one or more analysis modules to execute logic that analyzes network activity stored by the rowcreate event;
in response to the detecting, generating an output by the one or more analysis modules and performing a rowupdate to one or more of the tables with the output, the rowupdate of the output binding to another of the analysis modules to invoke logic that neutralizes the network threat; and
in response to detecting the network threat, distributing the one or more of plural analysis modules associated with the detection of the threat to the analysis execution environment of one or more other of the network security platforms.
2. The method of claim 1 further comprising:
modifying the one or more of plural analysis modules associated with the detecting a network threat to neutralize the network threat at the analysis execution environment; and
neutralizing the network threat at the analysis execution environment of one or more of the network security platforms with monitored network activity stored in the memory by the sensor modules.
3. The method of claim 1 wherein the distributing the one or more of plural analysis modules further comprises:
communicating the one or more of plural analysis modules to the one or more network security platforms as one or more pluggable modules, each pluggable module having at least a predetermined set of one or more commands executable at the analysis execution environment;
executing the predetermined set of one or more commands at the analysis execution environment to load an executable of the one or more pluggable modules into a processor program memory; and
activating the executable in response to predetermined monitored network activity.
4. The method of claim 3 wherein activating further comprises:
binding the executable to a sensor table of the analysis execution environment;
providing the predetermined network activity to the sensor table of the analysis execution environment; and
in response to the providing, performing the executable with the predetermined monitored network activity.
5. The method of claim 3 wherein the executable comprises native code pushed into an execution path.
6. The method of claim 3 wherein the binding performs a rowcreate in response to the providing of the monitored network activity to the table.
7. The method of claim 3 wherein the binding performs a rowupdate in response to the providing of the monitored network activity to the table.
8. The method of claim 3 wherein the binding performs a rowdelete in response to the providing of the monitored network activity to the table.
9. A system for maintaining network security, the system comprising:
a processor operable to process information, the processor having integrated program memory;
an active memory interfaced with the processor, the active memory storing network telemetry information accessible by the processor;
a sensor execution environment defined in the processor and operable to run plural sensor modules that store network telemetry information to the active memory;
an analysis execution environment defined in the processor and operable to run plural analysis modules that analyze network telemetry information for network security threats;
wherein the plural sensor modules are further operable to store network telemetry information in a sensor table of the analysis execution environment with a rowcreate and wherein at least one of the plural analysis modules have one or more bindings that selectively invoke the at least one of the plural analysis modules in response to the rowcreate, the at least one of the plural analysis module initiating to analyze the network telemetry information as the sensor module stores the network telemetry information in the sensor table of the execution environment, the at least one of the plural analysis modules generating a threat output associated with a threat and storing the threat output in the active memory with a rowcreate, the threat output rowcreate invoking another of the plural analysis modules for neutralizing the threat by a binding of the another of the plural analysis modules to the threat output rowcreate so that monitoring, analysis and neutralization of the threat is performed in real time from the active memory.
10. The system of claim 9 wherein the plural sensor modules store network telemetry information in the sensor table in real time as the network telemetry information is received by the plural sensor modules.
11. The system of claim 10 wherein the binding of the analysis module responds to network telemetry information stored in the sensor table in real time as the network telemetry information is stored in the sensor table.
12. The system of claim 9 wherein each of the plural sensor modules comprise a unix subprocess operable to output a JSON structure having one of a structured message, a statistics message or a status message.
13. The system of claim 9 wherein the analysis modules comprise pluggable modules stored in the active memory and having native code in program memory of the processor, the native code loaded into the program memory in response to a predetermined API command of the analysis execution environment.
14. The system of claim 13 wherein analysis execution environment comprises an object oriented interface having subclasses, the object oriented interface providing calls from the pluggable module into the analysis execution environment with inherited methods.
15. A non-transitory machine readable medium comprising instructions operable to execute on a network security analysis execution environment to:
create in random access memory one or more tables, each table having plural rows, each row providing a structured record mapping names to network sensor values according to a schema;
apply one or more bindings having handlers associated with the one or more tables for responding to a network security event entered at the one or more tables, the one or more bindings invoking a first analysis module bound to predetermined of the tables by one or more rowcreate events;
in response to invoking the first analysis module, retrieve native code of the first analysis module operable to reside in program memory of a processor for responding to the network security event;
apply an interface operable to load the native code to the processor, the native code responding in real time to the network security events indicated by entries to one or more of the tables by analyzing the information entered in the one or more tables of the random access memory and bound to the analysis module and generating a threat output associated with a network threat; and
storing the threat output in the random access memory with a rowcreate, the threat output rowcreate invoking a second analysis module for neutralizing the threat by a binding of the second analysis module to the threat output rowcreate so that monitoring, analysis and neutralization of the network threat is performed in real time from the random access memory.
16. The machine readable medium of claim 15 further comprising instructions operable to execute on a sensor execution environment to:
detect predetermined network security events; and
enter the predetermined network security events to a predetermined table of the network security analysis execution environment.
17. The machine readable medium of claim 15 wherein the interface comprises an install command to create a persistent object and a start command to establish the native code in program memory of the processor.
18. The machine readable medium of claim 15 wherein one of the tables is a sensor table and the native code binds to sensor table for rowcreate events to invoke an action in real time upon receipt of information from a network sensor at the sensor table.