Computer network attribute bilateral inheritance
Current approaches to managing security intelligence data often address both threat and malicious behavior at the individual computer level, tracked by the Internet Protocol (IP) address. For example, important facts, observed behavior, and other indications that are tracked by security organizations are only tracked with respect to individual IP addresses. Bilateral network inheritance generally refers to inheriting a variety of attributes from parents to children and from children to parents in a computer network hierarchy. The computer network hierarchy may comprise various entities such as, for example, top level entities, autonomous systems, address ranges, and individual IP addresses.
1. A method comprising:
generating, via a processor, a parent data structure representing a top-level entity at a first layer of a network element hierarchy, the parent data structure including attributes associated with the top-level entity;
retrieving, at a first time, a plurality of child data structures representing a plurality of network elements of the top-level entity, the plurality of child data structures being disposed at a second layer of the network element hierarchy that is below the first layer of the network element hierarchy;
incorporating attributes of a first portion of the plurality of child data structures into the parent data structure based on an inspection of the plurality of child data structures, such that the parent data structure includes the attributes of the first portion of the plurality of child data structures, and such that the parent data structure does not include attributes of a second portion of the plurality of child data structures; and
sending, after inspecting the parent data structure, a signal to a device accessed by an analyst such that the device accessed by the analyst conducts a security threat mitigation analysis of a network element associated with a child data structure from the first portion of the plurality of child data structures based on inspection of the parent data structure and not inspection of the child data structure, the signal including (1) the attributes associated with the top-level entity, and (2) the attributes of the first portion of the plurality of child data structures, such that the attributes of the first portion of the plurality of child data structures provide context to the attributes associated with the top-level entity.
2. The method of claim 1 , wherein the signal includes at least one of (1) an indication of compromise of the network element associated with the child data structure from the first portion of the plurality of data structures, or (2) an indication of compromise of the top level entity.
3. The method of claim 1 , wherein an attribute of the top-level entity can include at least one of (1) a security report, (2) a threat indicator, (3) an observed malware behavior, or (4) a security characteristic.
4. The method of claim 1 , further comprising:
modifying, based on inspection of the attributes associated with the top-level entity, each child data structure from the first portion of the plurality of child data structures, such that that child data structure includes a portion of the attributes associated with the top-level entity, and such that inspection of each child data structure from the first portion of the plurality of child data structure reveals the portion of the attributes associated with the top-level entity and attributes associated with that child data structure, without inspection of the parent data structure.
5. The method of claim 1 , wherein:
a network element from the plurality of network elements is at least one of: (1) an autonomous system, (2) an Internet Protocol (IP) address, (3) an IP address range, or (4) a fully qualified domain name (FQDN), and
a representation of the network element is partially defined by the network element hierarchy.
6. The method of claim 1 , further comprising:
retrieving, at a second time after the first time, a plurality of child data structures being disposed at a third layer of the network element hierarchy that is below the first layer of the network element hierarchy and the second layer of the network element hierarchy;
modifying, based on inspection of attributes associated with the top-level entity, each child data structure from the plurality of child data structures disposed at the third layer of the network element hierarchy, such that each child data structure from the plurality of child data structures disposed at the third layer of the network element hierarchy includes the attributes associated with the top-level entity; and
determining, based on inspection of attributes associated with the top-level entity, not to modify at least one child data structure from the plurality of child data structures disposed at the second layer of the network element hierarchy.
7. A method comprising:
receiving a security attribute associated with a network element from a plurality of network elements associated with a top-level entity;
modifying, at a first time, a child data structure representing the network element, such that the child data structure includes the security attribute;
inspecting each child data structure of a plurality of child data structures associated with the plurality of network elements, the plurality of child data structures including the child data structure;
modifying a parent data structure associated with the top-level entity, such that the parent data structure includes the security attribute;
receiving, at a second time after the first time and from a device accessed by an analyst, a selection of the parent data structure;
sending, after inspecting the parent data structure, a signal to the device accessed by the analyst such that the device accessed the analyst conducts a security threat mitigation analysis of the network element, based on inspection of the parent data structure and not inspection of the child data structure representing the network element, the signal including (1) attributes associated with the top-level entity, and (2) the security attribute, such that the security attribute provides context to the attributes associated with the top-level entity.
8. The method of claim 7 , wherein the signal includes at least one of (1) an indication of compromise of the network element, or (2) an indication of compromise of the top level entity.
9. The method of claim 7 , wherein an attribute of the top-level entity can include at least one of (1) a security report, (2) a security indicator, (3) an observed behavior, or (4) a security characteristic.
10. The method of claim 7 , further comprising:
modifying the child data structure, such that that child data structure includes a portion of the attributes associated with the top-level entity, and such that inspection of the child data structure reveals the attributes associated with the top-level entity and attributes associated with the child data structure, without inspection of the parent data structure.
11. The method of claim 7 , wherein the network element from the plurality of network elements is one of: (1) an autonomous system, (2) an Internet Protocol (IP) address, (3) an IP address rage, or (4) a fully qualified domain name (FQDN).
12. The method of claim 7 , further comprising:
retrieving, at a third time after the first time and before the second time, a plurality of child data structures being disposed at a third layer of the network element hierarchy that is below the first layer of the network element hierarchy and the second layer of the network element hierarchy;
modifying, based on inspection of attributes associated with the top-level entity, a first portion of the plurality of child data structures disposed at the third layer of the network element hierarchy, such that each child data structure from the first portion of the plurality of child data structures disposed at the third layer of the network element hierarchy includes the attributes associated with the top-level entity; and
determining, based on inspection of attributes associated with the top-level entity and the business logic, not to modify a second portion of the plurality of child data structures disposed at the third layer of the network element hierarchy, the second portion of the plurality of child data structures being mutually exclusive of the first portion of the plurality of child data structures.
13. The method of claim 7 , further comprising:
retrieving, at a third time after the first time and before the second time, a plurality of child data structures being disposed at a third layer of the network element hierarchy that is below the first layer of the network element hierarchy and the second layer of the network element hierarchy;
determining, based on inspection of attributes associated with the top-level entity and based on a network element type of each network element associated with a first portion of the plurality of child data structures disposed at the third layer of the network element hierarchy, not to modify the first portion of the plurality of child data structures disposed at the third layer of the network element hierarchy.
14. An apparatus, comprising:
a memory; and
a processor operatively coupled to the memory and configured to define a parent data structure disposed at a top layer of a network element hierarchy, the parent data structure including attributes that are associated with a top-level entity;
the processor configured to define a plurality of child data structures disposed at least one layer of the network element hierarchy that is lower than the top layer of the network element hierarchy, each child data structure of the plurality of child data structures including an attribute associated with a network element from a plurality of network elements associated with the top-level entity;
the processor configured to determine whether to include the attributes associated with the plurality of child data structures in the parent data structure based on results of inspecting each child data structure from the plurality of child data structures, the processor configured to modify the parent data structure so as to include attributes associated with a first subset of the plurality of child data structures, in the parent data structure, and so as to not include attributes associated with a second subset of the plurality of child data structures, in the parent data structure, based on the results of inspecting each child data structure from the plurality of child data structures;
the processor configured to send, after modifying the parent data structure, a signal to a device accessed by an analyst such that the device accessed by the analyst conducts a security threat mitigation analysis of a network element from the plurality of network elements and associated with a child data structure from the first subset of the plurality of child data structures based on inspection of the parent data structure and not inspection of the child data structure, the signal including (1) the attributes that are associated with the top-level entity, and (2) an attribute of the network element, such that the attribute of the network element provides context to the attributes that are associated with the top-level entity.
15. The apparatus of claim 14 , wherein the signal includes at least one of (1) an indication of compromise of the network element from the plurality of network elements, or (2) an indication of compromise of the top level entity.
16. The apparatus of claim 14 , wherein an attribute of the top-level entity can include at least one of (1) a security report, (2) a security indicator, (3) an observed behavior, or (4) a security characteristic.
17. The apparatus of claim 14 , wherein the processor is configured to modify the child data structure, such that that child data structure includes a portion of the attributes associated with the top-level entity, and such that inspection of the child data structure reveals the attributes associated with the top-level entity and attributes associated with the child data structure, without inspection of the parent data structure.
18. The apparatus of claim 14 , wherein a network element type from the plurality of network elements is one of: (1) an autonomous system, (2) an Internet Protocol (IP) address, (3) an IP address rage, or (4) a fully qualified domain name (FQDN).
19. The apparatus of claim 14 , wherein the processor is configured to retrieve a plurality of child data structures being disposed at a lower layer of the network element hierarchy that is below the top layer of the network element hierarchy; and
the processor is configured to determine, based on inspection of attributes associated with the top-level entity and based on a network element type of each network element associated with a first portion of the plurality of child data structures disposed at the lower layer of the network element hierarchy, not to modify the first portion of the plurality of child data structures disposed at the lower layer of the network element hierarchy.
20. The apparatus of claim 14 , wherein:
the processor is configured to retrieve a plurality of child data structures being disposed at a lower layer of the network element hierarchy that is below the top layer of the network element hierarchy;
the processor is configured to determine, based on inspection of attributes associated with the top-level entity and based on a network element type of each network element associated with a first portion of the plurality of child data structures disposed at the lower layer of the network element hierarchy, not to include the attributes associated with the top-level entity in each of the first portion of the plurality of child data structures disposed at the lower layer of the network element hierarchy; and
the processor configured to generate a new set of attributes for each child data structure in the first portion of the plurality of child data structures disposed at the lower layer of the network element hierarchy, the new set of attributes being generated based in part on the attributes associated with the top-level entity and the attributes of that child data structure.