System for detecting threats using scenario-based tracking of internal and external network traffic
Disclosed is an improved approach to implement a system and method for detecting insider threats, where models are constructed that is capable of defining what constitutes the normal behavior for any given hosts and quickly find anomalous behaviors that could constitute a potential threat to an organization. The disclosed approach provides a way to identify abnormal data transfers within and external to an organization without the need for individual monitoring software on each host, by leveraging metadata that describe the data exchange patterns observed in the network.
1. A method for performing threat detection in a network comprising:
monitoring communications traffic in the network;
identifying a data exchange pattern, the data exchange pattern comprising a pull of data corresponding to data transferred to an internal host from an internal network location and a push of data corresponding to data delivered from the internal host to an external host;
determining whether the data exchange pattern is indicative of an insider threat by calculating a ratio of the pull of data relative to the push of data; and
reporting a threat if abnormal behavior is identified, wherein the abnormal behavior corresponds to the ratio having a value of approximately 1.
2. The method of claim 1 , further comprising modifying a learned baseline behavior for the internal host based at least on the abnormal behavior.
3. The method of claim 2 , wherein the learned baseline behavior for the internal host is built by monitoring a normal data exchange pattern between any internal hosts and internal resources in the network.
4. The method of claim 1 , wherein the value of approximately 1 correlates to a range of 0.8 to 1.2.
5. The method of claim 1 , wherein a data volume threshold is used to filter insignificant data exchanges.
6. The method of claim 1 , wherein metadata is extracted from the communications traffic, the metadata comprising at least one of data volume, data exchange frequency, data exchange attempts, data exchange rates, data exchange time periods, or any combination thereof.
7. The method of claim 1 , wherein weightings are applied to analyze the data exchange pattern.
8. The method of claim 7 , wherein the weightings are applied to important or sensitive assets or to certain absolute time periods such as time of day.
9. The method of claim 1 , wherein the data exchange pattern is analyzed over a given time period.
10. The method of claim 1 , where detected threats are stored in a threat database.
11. The method of claim 1 , wherein the threat detection encounters multiple sessions attributed to the internal host in a certain time window to determine whether a collection of sessions is indicative of malicious behavior.
12. A computer program product embodied on a non-transitory computer readable medium, the computer readable medium having stored thereon a sequence of instructions which, when executed by a processor causes the processor to execute a method for performing a process to detect threats in a network, the process comprising:
monitoring communications traffic in the network;
identifying a data exchange pattern the data exchange pattern comprising a pull of data corresponding to data transferred to an internal host from an internal network location and a push of data corresponding to data delivered from the internal host to an external host;
determining whether the data exchange pattern is indicative of an insider threat by calculating a ratio of the pull of data relative to the push of data; and
reporting a threat if abnormal behavior is identified, wherein the abnormal behavior corresponds to the ratio having a value of approximately 1.
13. The computer program product of claim 12 , further comprising modifying a learned baseline behavior for the internal host based at least on the abnormal behavior.
14. The computer program product of claim 13 , wherein the learned baseline behavior for the internal host is built by monitoring a normal data exchange pattern between any internal hosts and internal resources in the network.
15. The computer program product of claim 12 , wherein the value of approximately 1 correlates to a range of 0.8 to 1.2.
16. The computer program product of claim 12 , wherein a data volume threshold is used to filter insignificant data exchanges.
17. The computer program product of claim 12 , wherein metadata is extracted from the communications traffic, the metadata comprising at least one of data volume, data exchange frequency, data exchange attempts, data exchange rates, data exchange time periods, or any combination thereof.
18. The computer program product of claim 12 , wherein weightings are applied to analyze the data exchange pattern.
19. The computer program product of claim 18 , wherein the weightings are applied to important or sensitive assets or to certain absolute time periods such as time of day.
20. The computer program product of claim 12 , wherein the data exchange pattern is analyzed over a given time period.
21. The computer program product of claim 12 , where detected threats are stored in a threat database.
22. The computer program product of claim 12 , wherein the threat detection encounters multiple sessions attributed to the internal host in a certain time window to determine whether a collection of sessions is indicative of malicious behavior.
23. A system, comprising:
a computer processor to execute a set of program code instructions;
a memory to hold the set of program code instructions, in which the set of program code instructions comprises program code to perform:
monitoring communications traffic in a network;
identifying a data exchange pattern, the data exchange pattern comprising a pull of data corresponding to data transferred to an internal host from an internal network location and a push of data corresponding to data delivered from the internal host to an external host;
determining whether the data exchange pattern is indicative of an insider threat by calculating a ratio of the pull of data relative to the push of data; and
reporting a threat if abnormal behavior is identified, wherein the abnormal behavior corresponds to the ratio having a value of approximately 1 .
24. The system of claim 23 , further comprising modifying a learned baseline behavior for the internal host based at least on the abnormal behavior.
25. The system of claim 24 , wherein the learned baseline behavior for the internal host is built by monitoring a normal data exchange pattern between any internal hosts and internal resources in the network.
26. The system of claim 23 , wherein the value of approximately 1 correlates to a range of 0.8 to 1.2.
27. The system of claim 23 , wherein a data volume threshold is used to filter insignificant data exchanges.
28. The system of claim 23 , wherein metadata is extracted from the communications traffic, the metadata comprising at least one of data volume, data exchange attempts, data exchange frequency, data exchange rates, data exchange time periods, or any combination thereof.
29. The system of claim 23 , wherein weightings are applied to analyze the data exchange pattern.
30. The system of claim 29 , wherein the weightings are applied to important or sensitive assets or to certain absolute time periods such as time of day.
31. The system of claim 23 , wherein the data exchange pattern is analyzed over a given time period.
32. The system of claim 23 , where detected threats are stored in a threat database.
33. The system of claim 23 , wherein the threat detection encounters multiple sessions attributed to the internal host in a certain time window to determine whether a collection of sessions is indicative of malicious behavior.