Granted Patent B1

US 10,574,700 · App. 15/281,130 · Granted Feb 25, 2020

Abstract

Claims (91)

1. A computer-implemented method for managing computer security of client computing machines, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

monitoring a set of client computing devices;

receiving, by the computing device, security data on sets of security-related events from each client computing device in the set of client computing devices, wherein each set of security-related events comprises a set of computing actions that relate to a security incident on at least one client computing device in the set of client computing devices;

clustering the sets of security-related events by:

calculating a dissimilarity value, for each set of security-related events, that indicates a uniqueness of the set of security-related events in relation to other sets of security-related events using a dissimilarity function, wherein the dissimilarity function calculates the difference between at least two sets of security-related events;

creating at least one cluster by grouping sets of security-related events that have similar dissimilarity values, wherein a cluster comprises a classification of security-related behaviors;

adjusting the dissimilarity function based on a homogeneity of clusters of sets of security-related events; and

adjusting at least one cluster based on the adjusted dissimilarity function;

determining, based on clustering the sets of security-related events by the dissimilarity value, that a set of security-related events comprises an anomaly based on the classification of the cluster of the set of security-related events as an anomalous cluster; and

performing a security action, in response to determining that the set of security-related events comprises the anomaly, to enforce a security rule for the set of client computing devices.

2. The method of claim 1 , wherein the security data comprises at least one of:

a malware report;

a vulnerability scan;

a report of an attack;

a report of an attempted attack; and

data on a response to a security-related event.

3. The method of claim 1 , wherein the sets of security-related events comprise security-related events grouped by a timing of occurrence.

4. The method of claim 1 , wherein calculating the dissimilarity value comprises:

weighting each security-related event based on an attribute of the security-related event; and

calculating a total value for the set of security-related events.

5. The method of claim 4 , wherein the attribute of the security-related event comprises at least one of:

an inverse of a frequency of the security-related event in the security data;

a response to the security-related event;

a type of the security-related event;

a timing of the security-related event; and

a description of the security-related event.

6. The method of claim 1 , wherein adjusting the dissimilarity function comprises revising an algorithm to calculate the dissimilarity value of the set of security-related events such that the set of security-related events is more homogeneous with its cluster than with other clusters.

7. The method of claim 1 , wherein performing the security action comprises at least one of:

creating at least one new security rule for the anomaly;

alerting an administrator about the anomaly; and

alerting a client user about the anomaly.

8. The method of claim 1 , further comprising:

determining that other sets of security-related events within the cluster of the anomaly are anomalous; and

performing the security action on the other sets of security-related events.

9. The method of claim 1 , further comprising:

extracting target clusters of sets of security-related events for a target client computing device; and

sending the target clusters to the target client computing device.

10. A system for managing computer security of client computing machines, the system comprising:

a monitoring module, stored in memory, that monitors a set of client computing devices;

a reception module, stored in memory, that receives, by a computing device, security data on sets of security-related events from each client computing device in the set of client computing devices, wherein each set of security-related events comprises a set of computing actions that relate to a security incident on at least one client computing device in the set of client computing devices;

a clustering module, stored in memory, that clusters the sets of security-related events by:

calculating a dissimilarity value, for each set of security-related events, that indicates a uniqueness of the set of security-related events in relation to other sets of security-related events using a dissimilarity function, wherein the dissimilarity function calculates the difference between at least two sets of security-related events;

creating at least one cluster by grouping sets of security-related events that have similar dissimilarity values, wherein a cluster comprises a classification of security-related behaviors;

adjusting the dissimilarity function based on a homogeneity of clusters of sets of security-related events; and

adjusting at least one cluster based on the adjusted dissimilarity function;

a determination module, stored in memory, that determines, based on clustering the sets of security-related events by the dissimilarity value, that a set of security-related events comprises an anomaly based on the classification of the cluster of the set of security-related events as an anomalous cluster;

a performance module, stored in memory, that performs a security action, in response to determining that the set of security-related events comprises the anomaly, to enforce a security rule for the set of client computing devices; and

at least one hardware processor that executes the monitoring module, the reception module, the clustering module, the determination module, and the performance module.

11. The system of claim 10 , wherein the security data comprises at least one of:

a malware report;

a vulnerability scan;

a report of an attack;

a report of an attempted attack; and

data on a response to a security-related event.

12. The system of claim 10 , wherein the sets of security-related events comprise security-related events grouped by a timing of occurrence.

13. The system of claim 10 , wherein the clustering module calculates the dissimilarity value by:

weighting each security-related event based on an attribute of the security-related event; and

calculating a total value for the set of security-related events.

14. The system of claim 13 , wherein the attribute of the security-related event comprises at least one of:

an inverse of a frequency of the security-related event in the security data;

a response to the security-related event;

a type of the security-related event;

a timing of the security-related event; and

a description of the security-related event.

15. The system of claim 10 , wherein the clustering module adjusts the dissimilarity function by revising an algorithm to calculate the dissimilarity value of the set of security-related events such that the set of security-related events is more homogeneous with its cluster than with other clusters.

16. The system of claim 10 , wherein the performance module performs the security action by at least one of:

creating at least one new security rule for the anomaly;

alerting an administrator about the anomaly; and

alerting a client user about the anomaly.

17. The system of claim 10 , further comprising:

determining that other sets of security-related events within the cluster of the anomaly are anomalous; and

performing the security action on the other sets of security-related events.

18. The system of claim 10 , further comprising:

extracting target clusters of sets of security-related events for a target client computing device; and

sending the target clusters to the target client computing device.

19. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

monitor a set of client computing devices;

receive, by the computing device, security data on sets of security-related events from each client computing device in the set of client computing devices, wherein each set of security-related events comprises a set of computing actions that relate to a security incident on at least one client computing device in the set of client computing devices;

cluster the sets of security-related events by:

calculating a dissimilarity value, for each set of security-related events, that indicates a uniqueness of the set of security-related events in relation to other sets of security-related events using a dissimilarity function, wherein the dissimilarity function calculates the difference between at least two sets of security-related events;

creating at least one cluster by grouping sets of security-related events that have similar dissimilarity values, wherein a cluster comprises a classification of security-related behaviors;

adjusting the dissimilarity function based on a homogeneity of clusters of sets of security-related events; and

adjusting at least one cluster based on the adjusted dissimilarity function;

determine, based on clustering the sets of security-related events by the dissimilarity value, that a set of security-related events comprises an anomaly based on the classification of the cluster of the set of security-related events as an anomalous cluster; and

perform a security action, in response to determining that the set of security-related events comprises the anomaly, to enforce a security rule for the set of client computing devices.

20. The non-transitory computer-readable medium of claim 19 , wherein the security data comprises at least one of:

a malware report;

a vulnerability scan;

a report of an attack;

a report of an attempted attack; and

data on a response to a security-related event.

Assignments (6)