Risk-chain generation of cyber-threats
View Patent ↗A method and system for cyber threat risk-chain generation are provided. The method includes obtaining a plurality of events; mapping each event of the plurality of obtained events to a global threat type, wherein each global threat type is associated with a risk-chain group; correlating among the mapped plurality of events to determine at least a transition between one global threat type to another; and updating a data structure maintaining data of at least one risk-chain, when the transition is determined, wherein the at least one risk-chain is a lifecycle of a cyber-attack.
1. A method for cyber threat risk-chain generation, comprising:
obtaining a plurality of events;
mapping each event of the plurality of obtained events to a global threat type, wherein each global threat type is associated with a risk-chain group;
correlating among the mapped plurality of events to determine at least a transition between one global threat type to another; and
updating a data structure maintaining data of at least one risk-chain, when the transition is determined, wherein the at least one risk-chain is a lifecycle of a cyber-attack.
2. The method of claim 1 , wherein obtaining the plurality of events further comprises:
generating the plurality of events in response to signals received from at least one security engine;
filtering the events based on a set of predefined filters; and
aggregating the plurality of events for each of at least one tenant, wherein each tenant is at least a protected object.
3. The method of claim 2 , further comprising:
generating the at least one risk-chain for each tenant.
4. The method of claim 1 , wherein mapping each event of the plurality of obtained events further comprises:
mapping the event to a global threat type based on at least one mapping rule.
5. The method of claim 1 , wherein mapping each event of the plurality of obtained events further comprises:
mapping the event to a global threat type based on a classification model.
6. The method of claim 1 , wherein the global threat type defines a certain type of malicious activity and includes at least any of: an action, a control, a propagation, a probe, and a social engineering.
7. The method of claim 6 , wherein the action global threat type is associated with an effect only risk-chain group; wherein the control global threat type is associated with a cause-and-effect risk-chain group; wherein the propagation global threat type is associated with a cause-and-effect risk-chain group; wherein the probe global threat type is associated with a cause-and-effect risk-chain group; wherein the social engineering global threat type is associated with a cause-only risk-chain group.
8. The method of claim 1 , wherein each of the at least one risk-chain includes at least one node and at least one segment connected thereto, wherein each of the at least one node represents a global threat type and each of the at least one segment is any of: a transition from one global threat type to another, and a self-loop in the global threat type.
9. The method of claim 8 , further comprising:
determining a risk level for each segment and an attack risk level for the at least one risk-chain.
10. The method of claim 9 , wherein the cyber-attack is a multi-vector attack and each node in the at least one risk-chain is a stage in the cyber-attack.
11. The method of claim 9 , wherein correlating among the plurality of events further comprises:
matching each two events of the plurality of events based on at least one matching rule.
12. The method of claim 11 , wherein the matching rule is a logical rule defining at least one matching condition, a segment risk level for a segment, and a state action of a segment.
13. The method of claim 11 , wherein the state action is any of: transition, and self-loop.
14. The method of claim 1 , wherein each of the at least one matching condition is based on at least one of: an entity type, a device type, a device group, an event order.
15. The method of claim 1 , further comprising:
providing a state machine to monitor the lifecycle of the cyber-attack, wherein the state machine is realized based on the at least one risk-chain representing the cyber-attack and an aging counter.
16. The method of claim 15 , wherein the state machine includes at least the following states: a start state representing an initial stage of the cyber-attack; an intermediate state representing a mature stage of the cyber-attack; an advanced state representing the cyber-attack having at least an effect-only segment in the at least risk-chain; a closed-wait state; and a closed state.
17. The method of claim 16 , further comprising:
updating the aging counter based on a transition from one state to another in the state machine.
18. The method of claim 1 , wherein the cyber-attack is an advanced persistent threat (APT) multi-vector attack campaign.
19. A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute a method, the method comprising:
obtaining a plurality of events, wherein each event is generated by a security application;
mapping each event of the plurality of obtained events to a global threat type, wherein each global threat type is associated with a risk-chain group;
correlating among the mapped plurality of events to determine at least a transition between one global threat type to another; and
updating a data structure maintaining data of at least one risk-chain, when the transition is determined, wherein the at least one risk-chain is a lifecycle of a cyber-attack.
20. A system for cyber threat risk-chain generation, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
obtain a plurality of events, wherein each event is generated by a security application;
map each event of the plurality of obtained events to a global threat type, wherein each global threat type is associated with a risk-chain group;
correlate among the mapped plurality of events to determine at least a transition between one global threat type to another; and
update a data structure maintaining data of at least one risk-chain, when the transition is determined, wherein the at least one risk-chain is a lifecycle of a cyber-attack.
21. The system of claim 20 , wherein the system is further configured to:
generate the plurality of events in response to signals received from at least one security engine;
filter the events based on a set of predefined filters; and
aggregate the plurality of events for each of at least one tenant, wherein each tenant is at least a protected object.
22. The system of claim 21 , wherein the system is further configured to:
generate the at least one risk-chain for each tenant.
23. The system of claim 20 , wherein the system is further configured to:
map the event to a global threat type based on at least one mapping rule.
24. The system of claim 20 , wherein the system is further configured to:
map the event to a global threat type based on a classification model.
25. The system of claim 20 , wherein the global threat type defines a certain type of malicious activity and includes at least any of: an action, a control, a propagation, a probe, and a social engineering.
26. The system of claim 25 , wherein the action global threat type is associated with an effect only risk-chain group; wherein the control global threat type is associated with a cause-and-effect risk-chain group; wherein the propagation global threat type is associated with a cause-and-effect risk-chain group; wherein the probe global threat type is associated with a cause-and-effect risk-chain group; wherein the social engineering global threat type is associated with a cause-only risk-chain group.
27. The system of claim 20 , wherein each of the at least one risk-chain includes at least one node and at least one segment connected thereto, wherein each of the at least one node represents a global threat type and each of the at least one segment is any of: a transition from one global threat type to another, and a self-loop in the global threat type.
28. The system of claim 27 , wherein the system is further configured to:
determine a risk level for each segment and an attack risk level for the at least one risk-chain.
29. The system of claim 28 , wherein the cyber-attack is a multi-vector attack and each node in the at least one risk-chain is a stage in the cyber-attack.
30. The system of claim 28 , wherein the system is further configured to:
match each two events of the plurality of events based on at least one matching rule.
31. The system of claim 30 , wherein the matching rule is a logical rule defining at least one matching condition, a segment risk level for a segment, and a state action of a segment.
32. The system of claim 30 , wherein the state action is any of: transition, and self-loop.
33. The method of claim 20 , wherein each of the at least one matching condition is based on at least one of: an entity type, a device type, a device group, an event order.
34. The system of claim 20 , wherein the system is further configured to:
provide a state machine to monitor the lifecycle of the cyber-attack, wherein the state machine is realized based on the at least one risk-chain representing the cyber-attack and an aging counter.
35. The system of claim 34 , wherein the state machine includes at least one state, wherein the at least one state includes: a start state representing an initial stage of the cyber-attack; an intermediate state representing a mature stage of the cyber-attack; an advanced state representing the cyber-attack having at least an effect-only segment in the at least risk-chain; a closed-wait state; and a closed state.
36. The system of claim 35 , wherein the system is further configured to:
update the aging counter based on a transition from one state to another in the state machine.
37. The system of claim 20 , wherein the cyber-attack is an advanced persistent threat (APT) multi-vector attack campaign.