Automated blackbox inference of external origin user behavior
Methods and systems for security analysis include determining whether a process has an origin internal to a system or external to the system using a processor based on monitored behavior events associated with the process. A security analysis is performed on only processes that have an external origin to determine if any of the processes having an external origin represent a security threat. A security action is performed if a process having an external origin is determined to represent a security threat.
1. A method for security analysis, comprising:
determining that a process, which is executed on a system, has an origin external to the system using a processor based on monitored behavior events associated with the process, by determining that the process is initiated by an action external to the system or is descended from a process that is initiated by an actin external to the system;
determining that the process represents a security threat by a security analysis; and
performing a security action responsive to the determination that the process represent a security threat.
2. The method of claim 1 , wherein determining that a process has an origin external to the system comprises determining an event type for each monitored behavior event associated with the process.
3. The method of claim 2 , wherein determining that a process has an origin external to the system further comprises adding the process to an external origin session responsive to a determination that the process is associated with a successful authentication event.
4. The method of claim 2 , wherein determining that a process has an origin external to the system further comprises adding the process to an external origin session responsive to a determination that the process has an input/output property set.
5. The method of claim 2 , wherein determining that a process has an origin external to the system further comprises adding the process to an external origin session responsive to a determination that the process was created by a process in the external origin session.
6. The method of claim 1 , wherein determining that a process has an origin external to the system comprises adding each process to one of an internal origin session or an external origin session.
7. The method of claim 6 , wherein determining that a process has an origin external to the system further comprises adding all processes that do not belong to an external origin session to a shared internal origin session.
8. The method of claim 6 , wherein each external origin session is organized as a process tree.
9. The method of claim 8 , wherein an initiating process is a root node of a process tree and wherein every child process of the initiating process is a child node of the process tree.
10. A system for security analysis, comprising:
a process filter module configured to determine whether a process, which is executed on a system, has an origin external to the system based on monitored behavior events associated with the process, and to determine that a process has an origin external to the system if the process is initiated by an action external to the system or if the process is descended from a process that is initiated by an action external to the system;
a security analysis module configured to perform a security analysis on only processes that have an external origin to determine if any of the processes having an external origin represent a security threat;
a security action module configured to perform a security action if a process having an external origin is determined to represent a security threat.
11. The system of claim 10 , wherein the process filter module is further configured to determine an event type for each monitored behavior event associated with the process.
12. The system of claim 11 , wherein the process filter module is further configured to add the process to an external origin session if the process is associated with a successful authentication event.
13. The system of claim 11 , wherein the process filter module is further configured to add the process to an external origin session if the process has an input/output property set.
14. The system of claim 11 , wherein the process filter module is further configured to add the process to an external origin session if the process was created by a process in the external origin session.
15. The system of claim 10 , wherein the process filter module is further configured to add each process to one of an internal origin session or an external origin session.
16. The system of claim 15 , wherein the process filter module is further configured to add all processes that do not belong to an external origin session to a shared internal origin session.
17. The system of claim 15 , wherein each external origin session is organized as a process tree.
18. The system of claim 17 , wherein an initiating process is a root node of a process tree and wherein every child process of the initiating process is a child node of the process tree.