Cyber-security system and method for weak indicator detection and correlation to generate strong indicators
View Patent ↗A method for detecting a cyber-attack is described. The method features (i) collecting a first plurality of weak indicators, (ii) grouping a second plurality of weak indicators from the first plurality of weak indicators where the second plurality of weak indicators being lesser in number than the first plurality of weak indicators, and (iii) performing a correlation operation between the second plurality of weak indicators and one or more patterns or sequences of indicators associated with known malware. A weak indicator of the first plurality of weak indicators corresponds to data that, by itself, is not definitive as to whether the data is associated with a cyber-attack being conducted on a source of the weak indicator.
1. A computerized method for detecting a cyber-attack, the method comprising:
performing one or more analyses of one or more objects associated with network traffic to determine a plurality of indicators;
collecting a first plurality of weak indicators of the plurality of indicators, a first weak indicator of the first plurality of weak indicators corresponds to data that, by itself, is not definitive as to whether the data is associated with a cyber-attack being conducted on a source of the first weak indicator;
grouping a second plurality of weak indicators from the first plurality of weak indicators, the second plurality of weak indicators being lesser in number than the first plurality of weak indicators;
performing a correlation operation between the second plurality of weak indicators and one or more patterns or sequences of indicators associated with known malware; and
generating and issuing a report based on the correlation operation.
2. The computerized method of claim 1 , wherein the first weak indicator represents an indicator having a probability less than a first prescribed probability level of the cyber-attack being conducted on the source of the first weak indicator.
3. The computerized method of claim 2 , wherein the collecting of the first plurality of weak indicators comprises separating strong indicators from a plurality of indicators where remaining indicators of the plurality of indicators correspond to the first plurality of weak indicators, a first strong indicator corresponds to data that, based on its presence alone, represents a likelihood above a second prescribed probability level of the cyber-attack conducted on at least the source of the first strong indicator.
4. The computerized method of claim 1 , wherein each of first plurality of weak indicators corresponds to data that represents, based on its presence alone, a likelihood below a first prescribed probability level of the cyber-attack.
5. The computerized method of claim 1 , wherein the grouping of the second plurality of weak indicators comprises combining two or more weak indicators in accordance with one or more grouping factors.
6. The computerized method of claim 5 , wherein the grouping factors are static in nature.
7. The computerized method of claim 5 , wherein the grouping factors each comprise an index parameter.
8. The computerized method of claim 1 , wherein the one or more analyses include a dynamic analysis performed by one or more virtual machines.
9. A device for detecting a cyber-attack comprising:
data analyzer logic including an analysis logic, the data analyzer logic configured to conduct an analysis of one or more objects and to output a first plurality of indicators based on the analysis;
first indicator detection logic communicatively coupled to the data analyzer and operating in accordance with a first plurality of correlation rules, the first indicator detection logic to determine whether a prescribed level of correlation exists between each of the first plurality of indicators and an indicator associated with known malware to detect whether any of the first plurality of indicators constitutes a strong indicator that represents that a cyber-attack has potentially occurred on a source of the first plurality of indicators;
second indicator detection logic communicatively coupled to the data analyzer and operating in accordance with a second plurality of correlation rules, the second indicator detection logic to perform a correlation operation between (i) two or more indicators of a second plurality of indicators being a subset of the first plurality of indicators and each of the two or more indicators, individually, is not definitive as to whether a cyber-attack is being conducted on the source, and (ii) one or more patterns or sequences of indicators associated with known malware, the correlation operation to determine whether the two or more indicators correspond to a strong indicator that represents the cyber-attack has potentially occurred on the source of the first plurality of indicators; and
reporting logic communicatively coupled to the strong indicator detection logic and the weak indicator logic, the reporting logic to generate an alert at least in response to detection of the strong indicator by the second indicator detection logic.
10. The device of claim 9 , wherein the reporting logic further generates an alert in response to detection of the strong indicator by the first indicator detection logic.
11. The device of claim 9 , wherein the two or more indicators are assembled by grouping the two or more indicators in accordance with a first grouping scheme conducted in accordance with the second plurality of correlation rules.
12. The device of claim 9 , wherein the second indicator detection logic comprises:
a data store to store the two or more indicators;
grouping logic communicatively coupled to the data store, the grouping logic being configured to organize the second plurality of indicators; and
weak indicator analysis logic communicatively coupled to the data store, the weak indicator analysis logic to selectively collect the two or more indicators and perform the correlation operation between (i) the two or more indicators and (ii) the one or more patterns or sequences of indicators associated with known malware in accordance with the second plurality of correlation rules.
13. The device of claim 12 , wherein the grouping logic is configured to organize the second plurality of indicators into a prescribed schema for storage in the data store.
14. The device of claim 13 , wherein the prescribed schema are indexed based on a first index parameter and a second index parameter.
15. The device of claim 14 , wherein the first index parameter includes an indexing of the second plurality of indicators based on a time of detection.
16. The device of claim 14 , wherein the second index parameter includes an indexing of the second plurality of indicators by source identifier.
17. The device of claim 9 , wherein the one or more analyses include a dynamic analysis performed by one or more virtual machines.
18. A device for detecting a cyber-attack, comprising:
a processor; and
a memory coupled to the processor, the memory comprises:
a first module that, upon execution by the processor, performs one or more analyses of one or more objects associated with network traffic to determine a plurality of indicators;
a second module that, upon execution by the processor, collects a first plurality of weak indicators of the plurality of indicators, wherein each of the first plurality of weak indicators corresponds to data that, individually, is not definitive as to whether the data is associated with a cyber-attack,
a third module that, upon execution by the processor, groups a second plurality of weak indicators from the first plurality of weak indicators, the second plurality of weak indicators being lesser in number than the first plurality of weak indicators, the second set of weak indicators bring grouped based on a grouping factor that the second plurality of weak indicators share, and
a fourth module that, upon execution by the processor, performs a correlation operation between the second plurality of weak indicators and one or more patterns or sequences of indicators associated with known malware.
19. The device of claim 18 , wherein the first weak indicator represents an indicator having a probability less than a prescribed probability level of the cyber-attack being conducted on the source of the first weak indicator.
20. The device of claim 18 , wherein the one or more analyses include a dynamic analysis performed by one or more virtual machines.