Selective structure preserving obfuscation
Obfuscating data is disclosed. A processor identifies structured information in log data. The structured information is transformed in a manner that preserves the structure to form transformed raw data. The transformed raw data is sent to a remote analysis engine. The remote analysis engine receives a query and responds to the query by providing as results at least a portion of the transformed raw data. A processor is configured to de-transform the transformed raw data.
1. A system, comprising:
a set of one or more interfaces configured to receive, from one or more blade modules, log data;
a collector module configured to, using a set of one or more processors:
identify structured information in the received log data;
transform the structured information such that the structure of the structured information is preserved, wherein the structured information is transformed using a map; and
cause the transformed information to be transmitted to a remote analysis engine; and
a memory coupled to the set of one or more processors and configured to provide the set of one or more processors with instructions.
2. The system of claim 1 wherein the collector module is configured to, using the set of one or more processors, transform the structured information using encryption.
3. The system of claim 1 wherein the collector module is configured to, using the set of one or more processors, transform a date included in the log data to a serial number.
4. The system of claim 1 wherein the collector module is configured to, using the set of one or more processors, transform an IP address included in the log data.
5. The system of claim 4 wherein transforming the IP address includes separately operating on each of the segments of an IPv4 address.
6. The system of claim 4 wherein transforming the IP address includes separately operating on each of the segments of an IPv6 address.
7. The system of claim 6 wherein operating on a segment includes reversing digits included in the segment.
8. The system of claim 6 wherein operating on a segment includes applying an offset.
9. The system of claim 1 wherein the collector module is configured to, using the set of one or more processors, transform the structured information in the log data without transforming other information in the log data.
10. The system of claim 1 wherein the structured information comprises persistent threat data.
11. The system of claim 1 wherein identifying the structured information includes detecting in the log data a presence of persistent threat data.
12. The system of claim 1 wherein identifying the structured information includes selecting the structured information based on a schema.
13. The system of claim 1 wherein the set of one or more interfaces is further configured to receive instructions from a user that indicate that a first kind of data is to be transformed and a second kind of data is not to be transformed.
14. The system of claim 1 wherein the set of one or more interfaces is further configured to receive the map from a user.
15. The system of claim 14 wherein the map is encrypted using a key.
16. The system of claim 15 wherein the key is selected by the user.
17. The system of claim 1 wherein the transforming is configured according to a user configuration of at least one of the collector module and the one or more blade modules.
18. A method, comprising:
receiving, via a set of one or more interfaces, log data from one or more blade modules;
identifying, by a collector module and using a set of one or more processors, structured information in the received log data;
transforming, by the collector module and using the set of one or more processors, the structured information such that the structure of the structured information is preserved, wherein the structured information is transformed using a map; and
causing, by the collector module and using the set of one or more processors, the transformed information to be transmitted to a remote analysis engine.
19. The method of claim 18 wherein the structured information is transformed using encryption.
20. The method of claim 18 wherein a date included in the log data is transformed to a serial number.
21. The method of claim 18 wherein an IP address included in the log data is transformed.
22. The method of claim 21 wherein transforming the IP address includes separately operating on each of the segments of an IPv4 address.
23. The method of claim 21 wherein transforming the IP address includes separately operating on each of the segments of an IPv6 address.
24. The method of claim 23 wherein operating on a segment includes reversing digits included in the segment.
25. The method of claim 23 wherein operating on a segment includes applying an offset.
26. The method of claim 18 wherein the structured information in the log data is transformed without transforming other information in the log data.
27. The method of claim 18 wherein the structured information comprises persistent threat data.
28. The method of claim 18 wherein identifying the structured information includes detecting in the log data a presence of persistent threat data.
29. The method of claim 18 wherein identifying the structured information includes selecting the structured information based on a schema.
30. The method of claim 18 further comprising receiving, via the set of one or more interfaces, instructions from a user that indicate that a first kind of data is to be transformed and a second kind of data is not to be transformed.
31. The method of claim 18 further comprising receiving, via the set of one or more interfaces, the map from a user.
32. The method of claim 31 wherein the map is encrypted using a key.
33. The method of claim 32 wherein the key is selected by the user.
34. The method of claim 18 wherein the transforming is configured according to a user configuration of at least one of the collector module and the one or more blade modules.
35. A system, comprising:
a set of one or more interfaces configured to receive:
log data from one or more blade modules; and
a map from a user;
a collector module configured to, using a set of one or more processors:
identify structured information in the received log data;
transform the structured information such that the structure of the structured information is preserved; and
cause the transformed information to be transmitted to a remote analysis engine; and
a memory coupled to the set of one or more processors and configured to provide the set of one or more processors with instructions.
36. The system of claim 35 wherein the collector module is configured to, using the set of one or more processors, transform the structured information using encryption.
37. The system of claim 35 wherein the collector module is configured to, using the set of one or more processors, transform the structured information using the map.
38. The system of claim 35 wherein the collector module is configured to, using the set of one or more processors, transform a date included in the log data to a serial number.
39. The system of claim 35 wherein the collector module is configured to, using the set of one or more processors, transform an IP address included in the log data.
40. The system of claim 39 wherein transforming the IP address includes separately operating on each of the segments of an IPv4 address.
41. The system of claim 39 wherein transforming the IP address includes separately operating on each of the segments of an IPv6 address.
42. The system of claim 41 wherein operating on a segment includes reversing digits included in the segment.
43. The system of claim 41 wherein operating on a segment includes applying an offset.
44. The system of claim 35 wherein the collector module is configured to, using the set of one or more processors, transform the structured information in the log data without transforming other information in the log data.
45. The system of claim 35 wherein the structured information comprises persistent threat data.
46. The system of claim 35 wherein identifying the structured information includes detecting in the log data a presence of persistent threat data.
47. The system of claim 35 wherein identifying the structured information includes selecting the structured information based on a schema.
48. The system of claim 35 wherein the set of one or more interfaces is further configured to receive instructions from a second user that indicate that a first kind of data is to be transformed and a second kind of data is not to be transformed.
49. The system of claim 35 wherein the map is encrypted using a key.
50. The system of claim 49 wherein the key is selected by the user.
51. The system of claim 35 wherein the transforming is configured according to a user configuration of at least one of the collector module and the one or more blade modules.
52. A method, comprising:
receiving, via a set of one or more interfaces:
log data from one or more blade modules; and
a map from a user;
identifying, by a collector module and using a set of one or more processors, structured information in the received log data;
transforming, by the collector module and using the set of one or more processors, the structured information such that the structure of the structured information is preserved; and
causing, by the collector module and using the set of one or more processors, the transformed information to be transmitted to a remote analysis engine.
53. The method of claim 52 wherein the structured information is transformed using encryption.
54. The method of claim 52 wherein the structured information is transformed using the map.
55. The method of claim 52 wherein a date included in the log data is transformed to a serial number.
56. The method of claim 52 wherein an IP address included in the log data is transformed.
57. The method of claim 56 wherein transforming the IP address includes separately operating on each of the segments of an IPv4 address.
58. The method of claim 56 wherein transforming the IP address includes separately operating on each of the segments of an IPv6 address.
59. The method of claim 58 wherein operating on a segment includes reversing digits included in the segment.
60. The method of claim 58 wherein operating on a segment includes applying an offset.
61. The method of claim 52 wherein the structured information in the log data is transformed without transforming other information in the log data.
62. The method of claim 52 wherein the structured information comprises persistent threat data.
63. The method of claim 52 wherein identifying the structured information includes detecting in the log data a presence of persistent threat data.
64. The method of claim 52 wherein identifying the structured information includes selecting the structured information based on a schema.
65. The method of claim 52 further comprising receiving, via the set of one or more interfaces, instructions from a second user that indicate that a first kind of data is to be transformed and a second kind of data is not to be transformed.
66. The method of claim 52 wherein the map is encrypted using a key.
67. The method of claim 66 wherein the key is selected by the user.
68. The method of claim 52 wherein the transforming is configured according to a user configuration of at least one of the collector module and the one or more blade modules.
69. A system, comprising:
a set of one or more interfaces configured to receive, from one or more blade modules, log data;
a collector module configured to, using a set of one or more processors:
identify structured information in the received log data;
transform the structured information such that the structure of the structured information is preserved, wherein the transforming is configured according to a user configuration of at least one of the collector module and the one or more blade modules; and
cause the transformed information to be transmitted to a remote analysis engine; and
a memory coupled to the set of one or more processors and configured to provide the set of one or more processors with instructions.
70. The system of claim 69 wherein the collector module is configured to, using the set of one or more processors, transform the structured information using encryption.
71. The system of claim 69 wherein the collector module is configured to, using the set of one or more processors, transform the structured information using a map.
72. The system of claim 69 wherein the collector module is configured to, using the set of one or more processors, transform a date included in the log data to a serial number.
73. The system of claim 69 wherein the collector module is configured to, using the set of one or more processors, transform an IP address included in the log data.
74. The system of claim 73 wherein transforming the IP address includes separately operating on each of the segments of an IPv4 address.
75. The system of claim 73 wherein transforming the IP address includes separately operating on each of the segments of an IPv6 address.
76. The system of claim 75 wherein operating on a segment includes reversing digits included in the segment.
77. The system of claim 75 wherein operating on a segment includes applying an offset.
78. The system of claim 69 wherein the collector module is configured to, using the set of one or more processors, transform the structured information in the log data without transforming other information in the log data.
79. The system of claim 69 wherein the structured information comprises persistent threat data.
80. The system of claim 69 wherein identifying the structured information includes detecting in the log data a presence of persistent threat data.
81. The system of claim 69 wherein identifying the structured information includes selecting the structured information based on a schema.
82. The system of claim 69 wherein the set of one or more interfaces is further configured to receive instructions from a user that indicate that a first kind of data is to be transformed and a second kind of data is not to be transformed.
83. The system of claim 69 wherein the set of one or more interfaces is further configured to receive a map from a user.
84. The system of claim 83 wherein the map is encrypted using a key.
85. The system of claim 84 wherein the key is selected by the user.
86. A method, comprising:
receiving, via a set of one or more interfaces, log data from one or more blade modules;
identifying, by a collector module and using a set of one or more processors, structured information in the received log data;
transforming, by the collector module and using the set of one or more processors, the structured information such that the structure of the structured information is preserved, wherein the transforming is configured according to a user configuration of at least one of the collector module and the one or more blade modules; and
causing, by the collector module and using the set of one or more processors, the transformed information to be transmitted to a remote analysis engine.
87. The method of claim 86 wherein the structured information is transformed using encryption.
88. The method of claim 86 wherein the structured information is transformed using a map.
89. The method of claim 86 wherein a date included in the log data is transformed to a serial number.
90. The method of claim 86 wherein an IP address included in the log data is transformed.
91. The method of claim 90 wherein transforming the IP address includes separately operating on each of the segments of an IPv4 address.
92. The method of claim 90 wherein transforming the IP address includes separately operating on each of the segments of an IPv6 address.
93. The method of claim 92 wherein operating on a segment includes reversing digits included in the segment.
94. The method of claim 92 wherein operating on a segment includes applying an offset.
95. The method of claim 86 wherein the structured information in the log data is transformed without transforming other information in the log data.
96. The method of claim 86 wherein the structured information comprises persistent threat data.
97. The method of claim 86 wherein identifying the structured information includes detecting in the log data a presence of persistent threat data.
98. The method of claim 86 wherein identifying the structured information includes selecting the structured information based on a schema.
99. The method of claim 86 further comprising receiving, via the set of one or more interfaces, instructions from a user that indicate that a first kind of data is to be transformed and a second kind of data is not to be transformed.
100. The method of claim 86 further comprising receiving, via the set of one or more interfaces, a map from a user.
101. The method of claim 100 wherein the map is encrypted using a key.
102. The method of claim 101 wherein the key is selected by the user.