Advanced threat protection cross-product security controller
View Patent ↗A system for securing electronic devices includes a processor, non-transitory machine readable storage medium communicatively coupled to the processor, and a security controller. The security controller includes computer-executable instructions on the medium that are readable by the processor. The security controller is configured to determine a suspicious file from a client using security applications, identify whether the suspicious file has been encountered by other clients using the security applications, calculate a time range for which the suspicious file has been present on the clients, determine resources accessed by the suspicious file during the time range, and create a visualization of the suspicious file, a relationship between the suspicious file and the clients, the time range, and the resources accessed by the suspicious file during the time range.
1. At least one non-transitory machine readable storage medium, comprising computer-executable instructions carried on the machine readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
determine a suspicious file from a first client;
identify whether the suspicious file has been encountered by one or more second clients;
calculate a time range during which the suspicious file has been present on the first and second clients;
determine resources accessed by the suspicious file during the calculated time range; and
create a visualization of the suspicious file, a relationship between the suspicious file and the first and second clients, the calculated time range, and the resources accessed by the suspicious file during the calculated time range.
2. The medium of claim 1 , further comprising instructions for causing the processor to cross-reference an Indicator of Compromise (IoC) accessed by the suspicious file with IoCs accessed by other files.
3. The medium of claim 1 , further comprising instructions for causing the processor to:
cross-reference Indicators of Compromise (IoCs) accessed by the suspicious file with IoCs accessed by other files;
determine a second file that accessed a same IoC as the suspicious file; and
categorize the second file as suspicious based upon its access of the same IoC as the suspicious file.
4. The medium of claim 1 , further comprising instructions for causing the processor to:
cross-reference Indicators of Compromise (IoCs) accessed by the suspicious file with IoCs accessed by one or more other files;
determine a second file that accessed a same IoC as the suspicious file;
identify a source of the second file; and
categorize the source as suspicious based upon its production of the second file and upon the second file's access of the same IoC as the suspicious file.
5. The medium of claim 1 , further comprising instructions for causing the processor to display a source of the suspicious file within the visualization.
6. The medium of claim 1 , further comprising instructions for causing the processor to display a security application that identified the suspicious file within the visualization.
7. The medium of claim 1 , wherein the clients include a user device, client electronic device, or a virtual machine.
8. A system, comprising:
a processor;
at least one non-transitory machine readable storage medium communicatively coupled to the processor; and
a security controller comprising computer-executable instructions on the medium, the instructions readable by the processor, the security controller configured to:
determine a suspicious file from a first client using one or more of a plurality of security applications;
identify whether the suspicious file has been encountered by one or more second clients using one or more of the security applications;
calculate a time range during which the suspicious file has been present on the first and second clients;
determine resources accessed by the suspicious file during the calculated time range; and
create a visualization of the suspicious file, a relationship between the suspicious file and the first and second clients, the calculated time range, and the resources accessed by the suspicious file during the calculated time range.
9. The system of claim 8 , wherein the security controller is further configured to cross-reference an Indicator of Compromise (IoC) accessed by the suspicious file with IoCs accessed by other files.
10. The system of claim 8 , wherein the security controller is further configured to:
cross-reference Indicators of Compromise (IoCs) accessed by the suspicious file with IoCs accessed by other files;
determine a second file that accessed a same IoC as the suspicious file; and
categorize the second file as suspicious based upon its access of the same IoC as the suspicious file.
11. The system of claim 8 , wherein the security controller is further configured to:
cross-reference Indicators of Compromise (IoCs) accessed by the suspicious file with IoCs accessed by one or more other files;
determine a second file that accessed a same IoC as the suspicious file;
identify a source of the second file; and
categorize the source as suspicious based upon its production of the second file and upon the second file's access of the same IoC as the suspicious file.
12. The system of claim 8 , wherein the security controller is further configured to display a source of the suspicious file within the visualization.
13. The system of claim 8 , wherein the security controller is further configured to display a security application that identified the suspicious file within the visualization.
14. The system of claim 8 , wherein the clients include a user device, client electronic device, or a virtual machine.
15. A method, comprising:
determining a suspicious file from a first client;
identifying whether the suspicious file has been encountered by one or more second clients;
calculating a time range during which the suspicious file has been present on the first and second clients;
determining resources accessed by the suspicious file during the calculated time range; and
creating a visualization of the suspicious file, a relationship between the suspicious file and the first and second clients, the calculated time range, and the resources accessed by the suspicious file during the calculated time range.
16. The method of claim 15 , further comprising cross-referencing an Indicator of Compromise (IoC) accessed by the suspicious file with IoCs accessed by other files.
17. The method of claim 15 , further comprising:
cross-referencing Indicators of Compromise (IoCs) accessed by the suspicious file with IoCs accessed by other files;
determining a second file that accessed a same IoC as the suspicious file; and
categorizing the second file as suspicious based upon its access of the same IoC as the suspicious file.
18. The method of claim 15 , further comprising:
cross-referencing Indicators of Compromise (IoCs) accessed by the suspicious file with IoCs accessed by one or more other files;
determining a second file that accessed a same IoC as the suspicious file;
identifying a source of the second file; and
categorizing the source as suspicious based upon its production of the second file and upon the second file's access of the same IoC as the suspicious file.
19. The method of claim 15 , further comprising displaying a source of the suspicious file within the visualization.
20. The method of claim 15 , further comprising displaying a security application that identified the suspicious file within the visualization.