Cybersecurity investigation tools utilizing information graphs
Example apparatus disclosed herein to perform a cybersecurity investigation include a graph generator to iteratively generate an information graph based on investigative data in response to detection of a threat alert in a monitored network, the investigative data accessed from information sources based on a set of information seeker tools, the information graph generated based on a graph schema specifying possible relationships between the information seeker tools. Example apparatus also include a pattern recognizer to traverse the information graph to identify a path in the information graph matching a pattern from the graph schema associated with a cybersecurity threat. Example apparatus further include a user interface to output the path identified in the information graph and the cybersecurity threat to an output device.
1. A non-transitory computer readable medium comprising computer readable instructions which, when executed, cause at least one processor to at least:
iteratively generate an information graph based on investigative data in response to detection of a threat alert in a monitored network, the investigative data accessed from information sources based on a set of information seeker tools, respective ones of the information seeker tools to specify input-output relationships between inputs and outputs of the respective ones of the information seeker tools, the respective ones of the information seeker tools to specify procedures to access the information sources to obtain output investigative data satisfying the input-output relationships specified by the respective ones of the information seeker tools for input investigative data applied to the respective ones of the information seeker tools, the information graph generated based on a graph schema specifying possible relationships between the information seeker tools, the information graph including vertices corresponding to the investigative data and links identifying the input-output relationships between the investigative data corresponding to the vertices, and to generate the information graph, the instructions cause the at least one processor to:
beginning with an initial vertex corresponding to first input investigative data associated with the detected threat alert, obtain respective first output investigative data for ones of a first subset of information seeker tools having respective inputs corresponding to the first investigative data, the respective first output investigative data to be obtained based on the procedures specified by the ones of the first subset of information seeker tools; and
connect, based on the graph schema, the initial vertex corresponding to the first input investigative data to respective first output vertices corresponding to the respective first output investigative data obtained for the ones of the first subset of information seeker tools to generate a first iteration of the information graph, the initial vertex and the respective first output vertices to be connected with first links identifying the input-output relationships specified by the ones of the first subset of information seeker tools to relate the initial vertex to the respective first output vertices;
traverse the information graph to identify a path in the information graph matching a pattern from the graph schema associated with a cybersecurity threat; and
output the path identified in the information graph and the cybersecurity threat to an output device.
2. The non-transitory computer readable medium of claim 1 , wherein the information sources include at least one of a reputation service, a log server or a threat intelligence knowledge database, and the respective ones of the information seeker tools specify respective procedures for accessing the at least one of the reputation service, the log server or the threat intelligence knowledge database to obtain the output investigative data satisfying the input-output relationships specified by the respective ones of the information seeker tools for the input data.
3. The non-transitory computer readable medium of claim 1 , wherein the instructions cause the at least one processor to:
obtain respective second output investigative data for ones of a second subset of information seeker tools having respective inputs corresponding to the respective first output investigative data, the respective second output investigative data to be obtained based on the procedures specified by the ones of the second subset of information seeker tools; and
connect, based on the graph schema, the respective first output vertices to respective second output vertices corresponding to the respective second output investigative data obtained for the ones of the second subset of information seeker tools to generate a second iteration of the information graph, the respective first output vertices and the respective second output vertices to be connected with second links identifying the input-output relationships specified by the ones of the second subset of information seeker tools to relate the initial vertex to the respective first output vertices.
4. The non-transitory computer readable medium of claim 3 , wherein the path is a first path, and the instructions cause the at least one processor to:
traverse the second iteration of the information graph to identify a second path matching a portion of the pattern from the graph schema;
in response to identification of the information path, select one of the information seeker tools capable of expanding the second path to form the first path matching the pattern from the graph schema;
obtain third output investigative data based on the selected one of the information seeker tools;
connect, based on the graph schema, a third output vertex to the second iteration of the information graph, the third output vertex corresponding to the third output investigative data obtained based on the selected one of the information seeker tools to generate a third iteration of the information graph; and
determine whether the third output vertex expanded the second path to form the first path.
5. The non-transitory computer readable medium of claim 1 , wherein the instructions cause the at least one processor to:
log respective iterations of the information graph in a computer accessible format; and
output one or more of the logged iterations of the information graph in response to a request.
6. An apparatus to perform a cybersecurity investigation, the apparatus comprising:
a graph generator to iteratively generate an information graph based on investigative data in response to detection of a threat alert in a monitored network, the investigative data accessed from information sources based on a set of information seeker tools, respective ones of the information seeker tools to specify input-output relationships between inputs and outputs of the respective ones of the information seeker tools, the respective ones of the information seeker tools to specify procedures to access the information sources to obtain output investigative data satisfying the input-output relationships specified by the respective ones of the information seeker tools for input investigative data applied to the respective ones of the information seeker tools, the information graph generated based on a graph schema specifying possible relationships between the information seeker tools, the information graph including vertices corresponding to the investigative data and links identifying the input-output relationships between the investigative data corresponding to the vertices, and the graph generator is to:
beginning with an initial vertex corresponding to first input investigative data associated with the detected threat alert, obtain respective first output investigative data for ones of a first subset of information seeker tools having respective inputs corresponding to the first investigative data, the respective first output investigative data to be obtained based on the procedures specified by the ones of the first subset of information seeker tools; and
connect, based on the graph schema, the initial vertex corresponding to the first input investigative data to respective first output vertices corresponding to the respective first output investigative data obtained for the ones of the first subset of information seeker tools to generate a first iteration of the information graph, the initial vertex and the respective first output vertices to be connected with first links identifying the input-output relationships specified by the ones of the first subset of information seeker tools to relate the initial vertex to the respective first output vertices;
a pattern recognizer to traverse the information graph to identify a path in the information graph matching a pattern from the graph schema associated with a cybersecurity threat; and
a user interface to output the path identified in the information graph and the cybersecurity threat to an output device, at least one of the graph generator, the pattern recognizer or the user interface implemented by hardware or processor circuitry.
7. The apparatus of claim 6 , wherein the information sources include at least one of a reputation service, a log server or a threat intelligence knowledge database, and the respective ones of the information seeker tools specify respective procedures for accessing the at least one of the reputation service, the log server or the threat intelligence knowledge database to obtain the output data satisfying the input-output relationships specified by the respective ones of the information seeker tools for the input data.
8. The apparatus of claim 6 , wherein the graph generator is to:
obtain respective second output investigative data for ones of a second subset of information seeker tools having respective inputs corresponding to the respective first output investigative data, the respective second output investigative data to be obtained based on the procedures specified by the ones of the second subset of information seeker tools; and
connect, based on the graph schema, the respective first output vertices to respective second output vertices corresponding to the respective second output investigative data obtained for the ones of the second subset of information seeker tools to generate a second iteration of the information graph, the respective first output vertices and the respective second output vertices to be connected with second links identifying the input-output relationships specified by the ones of the second subset of information seeker tools to relate the initial vertex to the respective first output vertices.
9. The apparatus of claim 8 , wherein the path is a first path, and:
the pattern recognizer is to traverse the second iteration of the information graph to identify a second path matching a portion of the pattern from the graph schema;
the graph generator is to:
in response to identification of the information path, select one of the information seeker tools capable of expanding the second path to form the first path matching the pattern from the graph schema;
obtain third output investigative data based on the selected one of the information seeker tools; and
connect, based on the graph schema, a third output vertex to the second iteration of the information graph, the third output vertex corresponding to the third output investigative data obtained based on the selected one of the information seeker tools to generate a third iteration of the information graph; and
the pattern recognizer is to determine whether the third output vertex expanded the second path to form the first path.
10. The apparatus of claim 6 , further including an information logger to log respective iterations of the information graph in a computer accessible format, and the user interface is to output one or more of the logged iterations of the information graph in response to a request.
11. A method to perform a cybersecurity investigation, the method comprising:
iteratively generating, by executing an instruction with at least one processor, an information graph based on investigative data in response to detection of a threat alert in a monitored network, the investigative data accessed from information sources based on a set of information seeker tools, respective ones of the information seeker tools specifying input-output relationships between inputs and outputs of the respective ones of the information seeker tools, the respective ones of the information seeker tools specifying procedures to access the information sources to obtain output investigative data satisfying the input-output relationships specified by the respective ones of the information seeker tools for input investigative data applied to the respective ones of the information seeker tools, the information graph generated based on a graph schema specifying possible relationships between the information seeker tools, the information graph including vertices corresponding to the investigative data and links identifying the input-output relationships between the investigative data corresponding to the vertices, the generating of the information graph including:
beginning with an initial vertex corresponding to first input investigative data associated with the detected threat alert, obtaining respective first output investigative data for ones of a first subset of information seeker tools having respective inputs corresponding to the first investigative data, the respective first output investigative data to be obtained based on the procedures specified by the ones of the first subset of information seeker tools; and
connecting, based on the graph schema, the initial vertex corresponding to the first input investigative data to respective first output vertices corresponding to the respective first output investigative data obtained for the ones of the first subset of information seeker tools to generate a first iteration of the information graph, the initial vertex and the respective first output vertices to be connected with first links identifying the input-output relationships specified by the ones of the first subset of information seeker tools to relate the initial vertex to the respective first output vertices;
traversing, by executing an instruction with the at least one processor, the information graph to identify a path in the information graph matching a pattern from the graph schema associated with a cybersecurity threat; and
outputting, by executing an instruction with the at least one processor, the path identified in the information graph and the cybersecurity threat to an output device.
12. The method of claim 11 , wherein the information sources include at least one of a reputation service, a log server or a threat intelligence knowledge database, and the respective ones of the information seeker tools specify respective procedures for accessing the at least one of the reputation service, the log server or the threat intelligence knowledge database to obtain the output data satisfying the input-output relationships specified by the respective ones of the information seeker tools for the input data.
13. The method of claim 11 , wherein the generating of the information graph includes:
obtaining respective second output investigative data for ones of a second subset of information seeker tools having respective inputs corresponding to the respective first output investigative data, the respective second output investigative data to be obtained based on the procedures specified by the ones of the second subset of information seeker tools; and
connecting, based on the graph schema, the respective first output vertices to respective second output vertices corresponding to the respective second output investigative data obtained for the ones of the second subset of information seeker tools to generate a second iteration of the information graph, the respective first output vertices and the respective second output vertices to be connected with second links identifying the input-output relationships specified by the ones of the second subset of information seeker tools to relate the initial vertex to the respective first output vertices.
14. The method of claim 13 , wherein the path is a first path, and the generating of the information graph includes:
traversing the second iteration of the information graph to identify a second path matching a portion of the pattern from the graph schema;
in response to identification of the information path, selecting one of the information seeker tools capable of expanding the second path to form the first path matching the pattern from the graph schema;
obtaining third output investigative data based on the selected one of the information seeker tools;
connecting, based on the graph schema, a third output vertex to the second iteration of the information graph, the third output vertex corresponding to the third output investigative data obtained based on the selected one of the information seeker tools to generate a third iteration of the information graph; and
determining whether the third output vertex expanded the second path to form the first path.