Systems and methods for detecting security threats
View Patent ↗The disclosed computer-implemented method for detecting security threats may include (1) detecting, by a software security program, a security incident at a client device such that the software security program generates a signature report to identify the security incident, (2) querying an association database with the signature report to deduce another signature report that a different software security program would have predictably generated at the client device, the different software security program having been unavailable at the client device at a time of detecting the security incident, and (3) performing at least one protective action to protect the client device from a security threat associated with the security incident based on the other signature report deduced by querying the association database. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for detecting security threats, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
detecting, by a software security product, a security incident at a client device such that the software security product generates a signature report to identify the security incident;
querying an association database with the signature report to deduce another signature report that a different software security product would have predictably generated at the client device, the different software security product having been unavailable at the client device at a time of detecting the security incident; and
performing at least one protective action to protect the client device from a security threat associated with the security incident based on the other signature report deduced by querying the association database, wherein:
the protective action comprises:
revising a security incident report to include information about the other signature report as a phantom event to provide context for the security incident; and
prompting a user to perform an action that is tailored to the other signature report, the action comprising at least one of:
updating an antivirus signature set;
executing an inoculation script;
enabling a security setting; and
disabling a hardware, virtual, and/or network computing resource; and
the other signature report satisfies a statistical threshold of correlation with the signature report that was actually generated.
2. The computer-implemented method of claim 1 , wherein the association database is constructed according to an association rule mining algorithm.
3. The computer-implemented method of claim 2 , wherein the association rule mining algorithm identifies a group of at least two signature reports that occur together beyond a threshold frequency.
4. The computer-implemented method of claim 1 , wherein deducing the other signature report comprises deducing at least two signature reports.
5. The computer-implemented method of claim 4 , further comprising filtering at least one signature report of the at least two signature reports based on a determination that the at least one signature report indicates a security compromise.
6. The computer-implemented method of claim 5 , wherein the determination that the at least one signature report indicates a security compromise comprises a determination that the signature report is associated disproportionately with security compromise situations according to a statistical measurement.
7. The computer-implemented method of claim 5 , wherein the determination that the at least one signature report indicates a security compromise comprises a determination that an automated measurement of confidence in the signature report indicating a security compromise satisfies a confidence threshold.
8. The computer-implemented method of claim 1 , wherein deducing the other signature report comprises inferring an attribute of the security incident.
9. The computer-implemented method of claim 8 , wherein the attribute comprises at least one of:
a file identifier for a file that caused the security incident;
a uniform resource locator for a web location that caused the security incident; and
an Internet Protocol address for a web location that caused the security incident.
10. The computer-implemented method of claim 8 , further comprising:
measuring a degree of confidence that the inferring of the attribute is correct; and
determining that the measured degree of confidence satisfies a confidence threshold.
11. A system for detecting security threats, the system comprising:
a detection module, stored in memory, that detects, as part of a software security product, a security incident at a client device such that the software security product generates a signature report to identify the security incident;
a querying module, stored in memory, that queries an association database with the signature report to deduce another signature report that a different software security product would have predictably generated at the client device, the different software security product having been unavailable at the client device at a time of detecting the security incident;
a performance module, stored in memory, that performs at least one protective action to protect the client device from a security threat associated with the security incident based on the other signature report deduced by querying the association database; and
at least one physical processor configured to execute the detection module, the querying module, and the performance module, wherein:
the protective action comprises:
revising a security incident report to include information about the other signature report as a phantom event to provide context for the security incident; and
prompting a user to perform an action that is tailored to the other signature report, the action comprising at least one of:
updating an antivirus signature set;
executing an inoculation script;
enabling a security setting; and
disabling a hardware, virtual, and/or network computing resource; and
the other signature report satisfies a statistical threshold of correlation with the signature report that was actually generated.
12. The system of claim 11 , wherein the association database is constructed according to an association rule mining algorithm.
13. The system of claim 12 , wherein the association rule mining algorithm identifies a group of at least two signature reports that occur together beyond a threshold frequency.
14. The system of claim 11 , wherein the querying module deduces the other signature report by deducing at least two signature reports.
15. The system of claim 14 , wherein the querying module filters at least one signature report of the at least two signature reports based on a determination that the at least one signature report indicates a security compromise.
16. The system of claim 15 , wherein the determination that the at least one signature report indicates a security compromise comprises a determination that the signature report is associated disproportionately with security compromise situations according to a statistical measurement.
17. The system of claim 15 , wherein the determination that the at least one signature report indicates a security compromise comprises a determination that an automated measurement of confidence in the signature report indicating a security compromise satisfies a confidence threshold.
18. The system of claim 11 , wherein the querying module deduces the other signature report by inferring an attribute of the security incident.
19. The system of claim 18 , wherein the attribute comprises at least one of:
a file identifier for a file that caused the security incident;
a uniform resource locator for a web location that caused the security incident; and
an Internet Protocol address for a web location that caused the security incident.
20. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
detect, by a software security product, a security incident at a client device such that the software security product generates a signature report to identify the security incident;
query an association database with the signature report to deduce another signature report that a different software security product would have predictably generated at the client device, the different software security product having been unavailable at the client device at a time of detecting the security incident; and
perform at least one protective action to protect the client device from a security threat associated with the security incident based on the other signature report deduced by querying the association database, wherein:
the protective action comprises:
revising a security incident report to include information about the other signature report as a phantom event to provide context for the security incident; and
prompting a user to perform an action that is tailored to the other signature report, the action comprising at least one of:
updating an antivirus signature set;
executing an inoculation script;
enabling a security setting; and
disabling a hardware, virtual, and/or network computing resource; and
the other signature report satisfies a statistical threshold of correlation with the signature report that was actually generated.