Systems and methods for generation of signature generation using interactive infection visualizations
According to one embodiment, a malware detection and visualization system includes one or more processors; and a storage module communicatively coupled to the one or more processors, the storage module comprises logic, upon execution by the one or more processors, that accesses a first set of information that comprises (i) information directed to a plurality of observed events and (ii) information directed to one or more relationships that identify an association between different observed events of the plurality of observed events; and generates a reference model based on the first set of information, the reference model comprises at least a first event of the plurality of observed events, a second event of the plurality of observed events, and a first relationship that identifies that the second event is based on the first event, wherein at least one of (i) the plurality of observed events or (ii) the one or more relationships constitutes an anomalous behavior is provided.
1. A cloud-computing system comprising:
one or more processors; and
a non-transitory storage module communicatively coupled to the one or more processors, the non-transitory storage module comprises logic, upon execution by the one or more processors, that:
observes a plurality of events within data received by the cloud-computing system over a network;
accesses a first set of information that comprises (i) information directed to the plurality of events, and (ii) information directed to one or more relationships that identify an association between different observed events of the plurality of events,
generates a reference model based on the first set of information, the reference model comprises at least a first event of the plurality of events, a second event of the plurality of events, and a first relationship that identifies that the second event is based on the first event,
generates an interactive, graphical display illustrating at least a subset of the plurality of events and the one or more relationships included in the reference model, wherein the interactive, graphical display represents the reference model as either a timeline visualization or an exploit visualization in the form of a nodal diagram with the subset of the plurality of events represented as nodes and a relationship of the subset represented as connections between the nodes on the graphical display,
receives user input via the interactive, graphical display corresponding to selection of a grouping of selected nodes and one or more selected connections of the subset via the interactive, graphical display, wherein the grouping by the user input indicates one or more of the nodes or one or more of the connections in the grouping is anomalous or suspicious or indicates a cyber-attack, and
responsive to receiving the user input, generates a signature representing the grouping.
2. The system of claim 1 , wherein an anomalous grouping includes a file opened by a first process, wherein the file is configured to be opened by a second process that is different from the first process and is not configured to be opened by the first process.
3. The system of claim 1 , wherein the generating of the reference model by the logic comprises determining that the first event of the plurality of observed events performed at least one of an action or an operation, the at least one of the action or the operation results in an observance of subsequent events of the plurality of observed events including the second event of the plurality of observed events.
4. The system of claim 1 , wherein at least one event of the first plurality of events is a first observed anomalous behavior, and at least one relationship of the one or more relationships is a second observed anomalous behavior.
5. The system of claim 1 , wherein the logic includes a machine learning engine to compare the plurality of events with events exhibited by known malware to determine that the plurality of events are indicative of malware.
6. The system of claim 5 , wherein the machine learning engine combines the signature comprising a second reference model associated with the malware with one or more other reference models to generate a malware family reference model.
7. The system of claim 1 , wherein operations performed by the logic are implemented as a forensic investigative tool configured to analyze malicious events or potentially malicious events included in the plurality of events.
8. The system of claim 1 , wherein the first relationship identifies a causal association between the first event and the second event.
9. The system of claim 1 , wherein generation of the reference model is performed by a machine learning engine.
10. The system of claim 9 , wherein the machine learning engine is activated automatically to generate the reference model in response to an alert condition that signifies detection of a malicious event.
11. The system of claim 9 , wherein the machine learning engine is activated manually by a user selecting the grouping and operates on at least the selected grouping.
12. The system of claim 9 wherein the machine learning engine.
13. The system of claim 1 , wherein the signature comprises a second reference model utilized for comparison against events observed at a later time for cyber-attack detection.
14. The system of claim 1 , wherein the data comprises log data received by the cloud computer system from one or more endpoints, threat detection systems or cloud computer systems.
15. The system of claim 1 , wherein the logic is coupled with a user interface rendering subsystem that generates one or more interactive display screens to allow a user to select displayed malicious events in order to acquire additional information about the grouping.
16. The system of claim 1 , wherein the logic generates the interactive, graphical display by at least displaying on a display screen a side-by-side comparison of the reference model and a reference model of known malicious events.
17. The system of claim 16 , wherein the logic includes matching logic to infer one or more events or one or more relationships based on the side-by-side comparison which inferred events or relationships were absent from the observed events and the one or more relationships.
18. The system of claim 1 , wherein the interactive, graphical display includes a generate signature button to activate the generation of the signature on the grouping.
19. The system of claim 18 , wherein the signature is generated representing the selected grouping and one or more events branching from the selected grouping.
20. The system of claim 1 , wherein the interactive, graphical display includes a generate alert button, which, when activated, issues an alert with respect to a selected grouping.
21. A method comprising:
observing a plurality of events within data received by a cloud-computing system over a network;
accessing a first set of information that comprises (i) information directed to the plurality of events, and (ii) information directed to one or more relationships that identify an association between different observed events of the plurality of events;
generating a reference model based on the first set of information, the reference model comprises at least a first event of the plurality of events, a second event of the plurality of events, and a first relationship that identifies that the second event is based on the first event;
generating an interactive, graphical display illustrating at least a subset of the plurality of events and relationships included in the reference model, wherein the interactive, graphical display represents the reference model as either a timeline visualization or an exploit visualization comprising a nodal diagram with the subset of the plurality of events represented as nodes and the subset of a relationships represented as connections between the nodes on the graphical display;
receiving user input corresponding to selection of a grouping of a plurality of selected nodes and one or more selected connections of the subset via the interactive, graphical display, wherein the grouping of the nodes or the one or more connections is anomalous or suspicious or indicates one or more nodes or one or more of the connections is anomalous, suspicious or indicates a cyber-attack; and
responsive to receiving the user input, generating a signature representing the grouping.
22. The method of claim 21 , wherein an anomalous grouping includes a file opened by a first process, wherein the file is configured to be opened by a second process that is different from the first process and is not configured to be opened by the first process.
23. The method of claim 21 , wherein the generating of the reference model comprises determining that the first event of the plurality of observed events performed at least one of an action or an operation, the at least one of the action or the operation results in an observance of subsequent events of the plurality of observed events including the second event of the plurality of observed events.
24. The method of claim 21 , wherein at least one event of the first plurality of events is a first observed anomalous behavior, and at least one relationship of the one or more relationships is a second observed anomalous behavior.
25. The method of claim 21 , wherein the method is implemented as a forensic investigative tool configured to determine malicious events.
26. The method of claim 21 , wherein the first relationship identifies a causal association between the first event and the second event.
27. The method of claim 21 , wherein generation of the reference model is performed by a machine learning engine.
28. The method of claim 21 , wherein the machine learning engine is activated automatically to generate the reference model in response to an alert condition that signifies detection of a malicious event.
29. The method of claim 21 , wherein the signature comprises a second reference model utilized for comparison against events observed at a later time to detect or otherwise analyze a cyber-attack.