System and method of detecting delivery of malware using cross-customer data
View Patent ↗According to one embodiment, an electronic device features processing circuitry and memory that includes a first logic and a second logic. When executed by the processing circuitry, the first logic organizes (i) a first plurality of indicators of compromise (IOCs) received from a first source, where the first plurality of IOCs being caused by a known origin of a malicious attack, and (ii) one or more IOCs received from a second source that is different from the first source and an origin of the one or more IOCs is unknown. The second logic conducts a predictive analysis that evaluates whether the one or more IOCs have at least a degree of correlation with the first plurality of IOCs, and determines a threat level. The threat level signifies a degree of confidence that IOCs received from the second source are caused by the known origin of the first plurality of IOCs.
1. An electronic device, comprising:
processing circuitry; and
a memory coupled to the processing circuitry, the memory includes
a data store to receive data associated with behaviors from a first source, the data associated with the behaviors from the first source being obtained from an analysis of one or more portions of a message for malware by a first network device of the first source;
first logic to determine, based on the data associated with the behaviors, whether a triggering event has occurred to prompt a predictive analysis to be conducted;
second logic to perform, based on an occurrence of the triggering event, the predictive analysis by (i) evaluating whether the data associated with the behaviors has at least a degree of correlation with data associated with a first plurality of behaviors received from a second source, where the first plurality of behaviors being caused by a known origin of a malicious attack, and (ii) determining a threat level signifying a degree of confidence that the data associated with the behaviors received from the first source is caused by the known origin of the first plurality of behaviors.
2. The electronic device of claim 1 , wherein the known origin of the malicious attack corresponds to an electronic mail message detected by the second source as including potential malware.
3. The electronic device of claim 1 , wherein the known origin of the malicious attack corresponds to a text message detected by the second source as including potential malware.
4. The electronic device of claim 1 , wherein the first logic determining that the triggering event has occurred in response to an increase in a number of occurrences or percentage of occurrences of a particular type of behavior.
5. The electronic device of claim 1 , wherein the triggering event signifies a likelihood that the data associated with the behaviors from the first source is caused by an undetected malicious electronic message present at the first source.
6. The electronic device of claim 1 , wherein the degree of correlation between the data associated with the behaviors and the data associated with the first plurality of behaviors is varied based on an operating state of the electronic device.
7. The electronic device of claim 1 , wherein the degree of correlation between the data associated with the behaviors and the data associated with the first plurality of behaviors for the predictive analysis is set to a first level when the electronic device is in a first operating state, the first level requires the data associated with the behaviors to be in a same chronological order and present within the data associated with the first plurality of behaviors.
8. The electronic device of claim 7 , wherein the degree of correlation between the data associated with the behaviors and the data associated with the first plurality of behaviors for the predictive analysis is set to a second level when the electronic device is in a second operating state, the second level requires a portion of the data associated with the behaviors to be present within the data associated with the first plurality of behaviors without the portion of the data associated with the behaviors being in the same chronological order as present within the data associated with the first plurality of behaviors.
9. The electronic device of claim 1 , wherein the data associated with the behaviors includes a second plurality of indicators of compromise (IOCs) associated with a message analyzed by the network device.
10. The electronic device of claim 1 further comprising alert generation logic to (i) determine a first type of response to be initiated in response to determining a first threat level in which the correlation between the data associated with the behaviors and the data associated with the first plurality of behaviors during the predictive analysis is equal to or exceeds the first level and (ii) determine a second type of response to be initiated in response to determining a second threat level in which the correlation between the data associated with the behaviors and the data associated with the first plurality of behaviors during the predictive analysis is equal to or exceeds the second threat level and is less than the first threat level, the second type of response including an alert to security personnel of the second source and the first type of response includes a plurality of alerts sent through different mediums.
11. A computerized method, comprising:
receiving data associated with behaviors provided from a first source, the data associated with the behaviors from the first source (i) being obtained from an analysis of one or more portions of a message for malware by a first network device of the first source;
determining, based on the data associated with the behaviors, whether a triggering event has occurred to prompt a predictive analysis to be conducted; and
responsive to an occurrence of the triggering event, performing the predictive analysis by at least (i) evaluating whether the data associated with the behaviors has at least a degree of correlation with data associated with a first plurality of behaviors received from a second source, where the first plurality of behaviors being caused by a known origin of a malicious attack, and (ii) determining a threat level, which signifies a degree of confidence that the data associated with the behaviors received from the first source is caused by the known origin of the first plurality of behaviors.
12. The method of claim 11 , wherein the known origin of the malicious attack corresponds to an electronic mail message detected by the second source as including potential malware.
13. The method of claim 12 , wherein the known origin of the malicious attack corresponds to a text message detected by the second source as including potential malware.
14. The method of claim 11 , wherein the determining whether the triggering event has occurred includes determining whether an increase in a number of occurrences or percentage of occurrences of a particular type of behavior has occurred at the first source.
15. The method of claim 11 , wherein the triggering event signifies a likelihood that the data associated with the behaviors from the first source is caused by an undetected malicious electronic message present at the first source.
16. The method of claim 11 , wherein the degree of correlation between the data associated with the behaviors and the data associated with the first plurality of behaviors is varied based on an operating state of an electronic device performing the predictive analysis.
17. The method of claim 11 , wherein the degree of correlation between the data associated with the behaviors and the data associated with the first plurality of behaviors is set to a first level when an electronic device performing the predictive analysis is in a first operating state, the first level requires the data associated with the behaviors to be in a same chronological order and present within the data associated with the first plurality of behaviors.
18. The method of claim 17 , wherein the degree of correlation between the data associated with the behaviors and the data associated with the first plurality of behaviors is set to a second level when an electronic device performing the predictive analysis is in a second operating state, the second level requires a portion of the data associated with the behaviors to be present within the data associated with the first plurality of behaviors without the portion of the data associated with the behaviors being in the same chronological order as present within the data associated with the first plurality of behaviors.
19. The non-transitory computer readable medium of claim 17 , wherein the degree of correlation between the data associated with the behaviors and the data associated with the first plurality of behaviors is set to a second level when an electronic device including the processor executing the software to perform the predictive analysis is in a second operating state, the second level requires a portion of the data associated with the behaviors to be present within the data associated with the first plurality of behaviors without the portion of the data associated with the behaviors being in the same chronological order as present within the data associated with the first plurality of behaviors.
20. The method of claim 11 , wherein the data associated with the behaviors includes a second plurality of indicators of compromise (IOCs) associated with a message analyzed by the first network device.
21. The method of claim 11 further comprising alert generation logic to (i) determine a first type of response to be initiated in response to determining a first threat level in which the correlation between the data associated with the behaviors and the data associated with the first plurality of behaviors during the predictive analysis is equal to or exceeds the first threat level and (ii) determine a second type of response to be initiated in response to determining a second threat level in which the correlation between the data associated with the behaviors and the data associated with the first plurality of behaviors during the predictive analysis is equal to or exceeds the second threat level and is less than the first threat level, the second type of response including an alert to security personnel of the second source and the first type of response includes a plurality of alerts sent through different mediums.
22. A non-transitory computer readable medium including software that, when executed by a processor, performs a plurality of operations comprising:
receiving data associated with behaviors provided from a first source, the data associated with the behaviors from the first source being obtained from an analysis of one or more portions of a message for malware at the first source;
performing a predictive analysis by at least (i) evaluating whether the data associated with the behaviors has at least a degree of correlation with data associated with a first plurality of behaviors received from a second source, where the first plurality of behaviors being caused by a known origin of a malicious attack, and (ii) determining a threat level, which signifies a degree of confidence that the data associated with the behaviors received from the first source is caused by the known origin of the first plurality of behaviors.
23. The non-transitory computer readable medium of claim 22 , wherein the known origin of the malicious attack corresponds to either an electronic mail message or a text message detected by the second source as including potential malware.
24. The non-transitory computer readable medium of claim 22 , wherein prior to performing the predictive analysis, the method further comprising:
determining, based on the data associated with the behaviors, whether a triggering event has occurred to prompt the predictive analysis to be conducted.
25. The non-transitory computer readable medium of claim 24 , wherein the determining whether the triggering event has occurred includes determining whether an increase in a number of occurrences or percentage of occurrences of a particular type of behavior has occurred at the first source.
26. The non-transitory computer readable medium of claim 25 , wherein the triggering event signifies a likelihood that the data associated with the behaviors from the first source is caused by an undetected malicious electronic message present at the first source.
27. The non-transitory computer readable medium of claim 22 , wherein the degree of correlation between the data associated with the behaviors and the data associated with the first plurality of behaviors is varied based on an operating state of an electronic device including the processor executing the software to perform the predictive analysis.
28. The non-transitory computer readable medium of claim 22 , wherein the degree of correlation between the data associated with the behaviors and the data associated with the first plurality of behaviors is set to a first level when an electronic device including the processor executing the software to perform the predictive analysis is in a first operating state, the first level requires the data associated with the behaviors to be in a same chronological order and present within the data associated with the first plurality of behaviors.
29. The non-transitory computer readable medium of claim 22 , wherein the data associated with the behaviors includes a second plurality of indicators of compromise (IOCs) associated with a message analyzed at the first source.