Correlation and consolidation of analytic data for holistic view of a malware attack
View Patent ↗According to one embodiment, a method for correlating and consolidating analytic data to provide a holistic view of a malware attack. The method comprises receiving analytic data from a plurality of electronic devices. The analytic data from each electronic device of the plurality of electronic devices comprises input attributes and analysis attributes. Thereafter, the analytic data is correlated by determining whether a first analysis attribute provided by a first electronic device of the plurality of electronic devices matches a second analysis attribute provided by a second electronic device of the plurality of electronic devices. In response determining that the first analysis attribute provided by the first electronic device matches the second analysis attribute provided by the second electronic device, the input attributes associated with the first analysis attribute and the second analysis attribute are consolidated for subsequent display.
1. A method for detecting a malware attack and displaying information associated with suspicious network content pertaining to the malware attack, the method comprising:
receiving analytic data including information associated with network content being monitored for malware, the analytic data being stored at least in a payload of a message from each of a plurality of electronic devices and including one or more input attributes and one or more analysis attributes;
correlating the analytic data that comprises determining whether a first analysis attribute provided by a first electronic device of the plurality of electronic devices matches a second analysis attribute provided by a second electronic device of the plurality of electronic devices;
responsive to determining that the first analysis attribute matches the second analysis attribute, consolidating input attributes associated with the first analysis attribute and the second analysis attribute for subsequent display; and
outputting, for display, information representing the consolidated input attributes to identify that a first network content associated with the first analysis attribute received from the first electronic device is the same as or related to a second network content associated with the second analysis attribute received from the second electronic device.
2. The method of claim 1 , wherein the first analysis attribute corresponds to a Uniform Resource Locator (URL) within the first network content being a first type of network content and the second analysis attribute corresponds to the URL within the second network content being a second type of network content.
3. The method of claim 2 , wherein the first type of network content corresponds to an electronic mail (email) message being different from the second type of network content.
4. The method of claim 3 , wherein the second type of network content comprises a file type.
5. The method of claim 1 , wherein the first type of network content includes an electronic mail (email) message that is analyzed for malware by the first electronic device and the second type of network content includes network traffic that is analyzed for malware by the second electronic device.
6. The method of claim 1 , wherein the first analysis attribute comprises at least one of (i) information related to a portion of the network content that is analyzed for malware within the first electronic device and (ii) one or more anomalous behaviors observed during malware detection analysis of the information.
7. The method of claim 6 , wherein the one or more input attributes associated with the first analysis attribute comprises at least one of (i) information identifying a destination of the first network content and (ii) information identifying a source of the first network content.
8. The method of claim 1 , wherein analytic data received from the first electronic device further comprises an identifier that identifies the first network content.
9. The method of claim 1 , wherein the first electronic device comprises a web-based security appliance to inspect ingress data traffic and to generate the message including at least the first attribute based on an analysis of the ingress data traffic.
10. The method of claim 1 , wherein the first analysis attribute includes data associated with an non-malicious behavior detected by the first electronic device.
11. The method of claim 10 , wherein the data associated with the anomalous behavior includes a first hash value, the first hash value being a result passed by conducting a hash operation on the data associated with the anomalous behavior.
12. The method of claim 1 , wherein the first analysis attribute includes a hash value of data associated with an anomalous behavior detected by the first electronic device and the second analysis attribute includes a hash value of data associated with an anomalous behavior detected by the second electronic device.
13. The method of claim 1 , wherein the first analysis attribute matches the second analysis attribute based on a finding of similarities between the first analysis attribute and the second analysis attribute.
14. The method of claim 1 , wherein the first analysis attribute matches the second analysis attribute based on a finding that a hash value of the first analysis attribute is identical to a hash value of the second analysis attribute.
15. A method for detecting a malware attack and displaying information associated with suspicious network content pertaining to the malware attack, the method comprising:
receiving the analytic data that comprises input attributes and analysis attributes, the analysis attributes include (a) information related to portions of the suspicious network content that are analyzed for malware and (b) one or more anomalous behaviors observed during analysis of the information related to the portions of the suspicious network content and the input attributes provide information related to (i) an entry point of network content into a network as detected by a first electronic device of the plurality of electronic devices and (ii) information related to a migration of the network content as monitored by a second electronic device of the plurality of electronic devices;
correlating the analytic data that comprises determining whether a first analysis attribute provided by the first electronic device matches a second analysis attribute provided by the second electronic device, the first analysis attribute comprises at least one of (i) information related to a portion of the network content that is analyzed for malware and (ii) one or more anomalous behaviors observed during malware detection analysis of the information; and
responsive to determining that the first analysis attribute matches the second analysis attribute, consolidating input attributes associated with the first analysis attribute and the second analysis attribute for subsequent display.
16. The method of claim 15 further comprising:
transmitting information associated the input attributes for display on an electronic device with display capabilities.
17. The method of claim 15 , wherein the first analysis attribute matches the second analysis attribute based on a finding of similarities between the first analysis attribute and the second analysis attribute.
18. The method of claim 15 , wherein the first analysis attribute matches the second analysis attribute based on a finding that a hash value of the first analysis attribute is identical to a hash value of the second analysis attribute.
19. The method of claim 15 , wherein one or more input attributes from the first electronic device identifies an email message with a Uniform Resource Locator (URL) that caused the network content to be downloaded and stored on a file share and one or more input attributes from the second electronic device identifies the migration of the network content from the file share to one or more electronic devices.
20. The method of claim 15 , wherein the input attributes from the first electronic device identifies a type of communication from which the suspicious network content originated, the type of communication includes an email message.
21. A system for detecting a malware attack on at least an electronic device that is part of a network, comprising:
one or more hardware processors; and
a memory coupled to the one or more hardware processors, the memory comprises
aggregation logic that, when executed by the one or more hardware processors, receives analytic data from a plurality of electronic devices that are part of the network, the analytic data comprises information associated with network content being monitored for malware, the information associated with the network content includes one or more input attributes and one or more analysis attributes,
correlation logic that, when executed by the one or more hardware processors, correlates the analytic data by at least determining whether a first analysis attribute provided by a first electronic device of the plurality of electronic devices matches a second analysis attribute provided by a second electronic device of the plurality of electronic devices,
consolation logic that, when executed by the one or more hardware processors and responsive to a determination that the first analysis attribute matches the second analysis attribute, consolidates input attributes associated with the first analysis attribute and the second analysis attribute, and
display logic that, when executed by the one or more hardware processors, generates and provides information associated the consolidated input attributes for display on an electronic device with display capabilities, the information further includes one or more images representing that the first analysis attribute detected by the first electronic device originated from network content analyzed by the second electronic device.
22. The system of claim 21 , wherein the correlation logic determines that the first analysis attribute matches the second analysis attribute based on a finding of similarities between the first analysis attribute and the second analysis attribute.
23. The method of claim 21 , wherein the correlation logic determines that the first analysis attribute matches the second analysis attribute based on a finding that a hash value of the first analysis attribute is identical to a hash value of the second analysis attribute.
24. A system for detecting a malware attack comprising:
one or more hardware processors; and
a memory coupled to the one or more hardware processors, the memory comprises
aggregation logic that, when executed by the one or more hardware processors, receives analytic data from a plurality of electronic devices, the analytic data comprises information associated with network content being monitored for malware, the information includes one or more input attributes and one or more analysis attributes,
correlation logic that, when executed by the one or more hardware processors, correlates the analytic data that comprises determining whether a first analysis attribute provided by a first electronic device of the plurality of electronic devices matches a second analysis attribute provided by a second electronic device of the plurality of electronic devices, and
consolation logic that, when executed by the one or more hardware processors and responsive to determining that the first analysis attribute matches the second analysis attribute, consolidates input attributes associated with the first analysis attribute and the second analysis attribute for subsequent display, and
display logic that, when executed by the one or more hardware processors, generates and provides display information based on the input attributes that identifies (i) an entry point of the network content into a network as detected by the first electronic device and (ii) information related to a migration of the network content as monitored by the second electronic device.
25. The system method of claim 24 , wherein the aggregation logic, when executed by the one or more hardware processors and in response to a triggering event, sends a message requesting the analytic data to at least one of the plurality of electronic devices.
26. The system of claim 24 , wherein the correlation logic determines that the first analysis attribute matches the second analysis attribute based on a finding of similarities between the first analysis attribute and the second analysis attribute.
27. The method of claim 24 , wherein the correlation logic determines that the first analysis attribute matches the second analysis attribute based on a finding that a hash value of the first analysis attribute is identical to a hash value of the second analysis attribute.
28. The system of claim 24 , wherein the display logic to display the entry point as an image to represent an origin of the suspicious network content.
29. A non-transitory storage medium including software that, when executed by one or more hardware processors, performs a plurality of operations, comprising:
correlating analytic data received from a plurality of electronic devices that are part of a network by determining whether a first analysis attribute in analytic data provided from a first electronic device of the plurality of electronic devices matches a second analysis attribute in analytic data provided from a second electronic device of the plurality of electronic devices, wherein the analytic data from the first electronic device and the second electronic device comprises one or more input attributes and one or more analysis attributes that are based on network content being monitored for malware;
responsive to determining that the first analysis attribute provided from the first electronic device matches the second analysis attribute provided from the second electronic device, consolidating input attributes associated with the first analysis attribute and the second analysis attribute for subsequent display; and
transmitting information associated the consolidated input attributes for display on an electronic device with display capabilities, the information includes (i) one or more images that represent a migration of network content associated with both the first analysis attribute and the second analysis attribute through a network and (ii) a first network content associated with the first analysis attribute is the same as or related to a second network content associated with the second analysis attribute.
30. The non-transitory storage medium of claim 29 , wherein the first analysis attribute corresponds to a Uniform Resource Locator (URL) within the first network content being a first type of network content and the second analysis attribute corresponds to the URL within the second network content being a second type of network content.
31. The non-transitory storage medium of claim 29 , wherein the analytic data includes information associated with network content being monitored for malware.
32. The non-transitory storage medium of claim 29 , wherein the first analysis attribute comprises at least one of (i) information related to portions of network content that are analyzed for malware and (ii) one or more anomalous behaviors observed during malware detection analysis of the information.
33. The non-transitory storage medium of claim 32 , wherein the input attributes comprise include at least one of (i) information identifying a destination of the network content and (ii) information identifying a source of the network content.
34. The non-transitory storage medium of claim 29 , wherein the software, when executed by one or more hardware processors, determines that the first analysis attribute in analytic data provided from the first electronic device matches the second analysis attribute in analytic data provided from the second electronic device based on a finding of similarities between the first analysis attribute and the second analysis attribute.
35. The non-transitory storage medium of claim 29 , wherein the software, when executed by one or more hardware processors, determines that the first analysis attribute in analytic data provided from the first electronic device matches the second analysis attribute in analytic data provided from the second electronic device based on a finding that a hash value of the first analysis attribute is identical to a hash value of the second analysis attribute.
36. A non-transitory storage medium including software that, when executed by one or more hardware processors, performs operations, comprising:
correlating analytic data received from a plurality of electronic devices by determining whether a first analysis attribute in analytic data provided from a first electronic device of the plurality of electronic devices matches a second analysis attribute in analytic data provided from a second electronic device of the plurality of electronic devices, wherein the analytic data from the first electronic device and the second electronic device comprises information associated with network content being monitored for malware, wherein the information includes one or more input attributes and one or more analysis attributes;
responsive to determining that the first analysis attribute provided from the first electronic device matches the second analysis attribute provided from the second electronic device, consolidating input attributes associated with the first analysis attribute and the second analysis attribute for subsequent display; and
outputting, for display, information representing the consolidated input attributes to identify that the second analysis attribute detected by the second electronic device is based on network content that is also received by the first electronic device.
37. The non-transitory storage medium of claim 36 , wherein the network content is a Uniform Resource Locator (URL).
38. The non-transitory storage medium of claim 36 , wherein the software, when executed by one or more hardware processors, determines that the first analysis attribute matches the second analysis attribute based on a finding of similarities between the first analysis attribute and the second analysis attribute.
39. The non-transitory storage medium of claim 36 , wherein the software, when executed by one or more hardware processors, determines that the first analysis attribute matches the second analysis attribute based on a finding that a hash value of the first analysis attribute is identical to a hash value of the second analysis attribute.
40. A system comprising:
one or more hardware processors;
a memory including one or more software modules that, when executed by the one or more hardware processors, correlates analytic data received from a plurality of sources to (1) determine if a first analysis attribute, which is associated with a first network content analyzed by a first source external to the system and provided from the first source as a portion of the analytic data, matches a second analysis attribute associated with a second network content analyzed by a second source external to the system and provided from the second source as a portion of the analytic data, and if a match is detected, (2) consolidate input attributes associated with the first analysis attribute and the second analysis attribute, and (3) output, for display, information representing the consolidated input attributes to identify that the first network content associated with the first analysis attribute analyzed by the first source is the same as or related to the second network content associated with the second analysis attribute analyzed by the second source.
41. The method of claim 8 , wherein the first identifier is a time-stamp value.
42. The system of claim 40 , wherein the first analysis attribute corresponds to a Uniform Resource Locator (URL) within the first network content being a first type of network content and the second analysis attribute corresponds to the URL within the second network content being a second type of network content.
43. The system of claim 42 , wherein the first type of network content includes an electronic mail (email) message that is analyzed for malware by the first source being a first electronic device and the second type of network content includes network traffic that is analyzed for malware by the second source being a second electronic device.
44. The system of claim 40 , wherein the first analysis attribute comprises at least one of (i) information related to a portion of the network content that is analyzed for malware by the first source being a first electronic device and (ii) one or more anomalous behaviors observed during malware detection analysis of the information.
45. The system of claim 44 , wherein the one or more input attributes associated with the first analysis attribute comprises at least one of (i) information identifying a destination of the first network content and (ii) information identifying a source of the first network content.
46. The system of claim 40 , wherein analytic data received from the first source being a first electronic device further comprises an identifier that identifies the first network content.
47. The system of claim 46 , wherein the first identifier is a time-stamp value.
48. The system of claim 40 , wherein the one or more software modules stored in the memory, when executed by the one or more hardware processors, determine that the first analysis attribute matches the second analysis attribute based on a finding of similarities between the first analysis attribute and the second analysis attribute.
49. The system of claim 40 , wherein the one or more software modules stored in the memory, when executed by the one or more hardware processors, determine that the first analysis attribute matches the second analysis attribute based on a finding that a hash value of the first analysis attribute is identical to a hash value of the second analysis attribute.