Systems and techniques for guiding a response to a cybersecurity incident
A cybersecurity engine can guide a forensic investigation of a security incident by estimating the utility of investigating events associated with the security incident, selecting a subset of such events based on the estimated utilities, and presenting data associated with the selected events to the investigator. A method for guiding a response to a security incident may include estimating, for each of a plurality of security events associated with the security incident, a utility of investigating the security event. The method may further include selecting a subset of the security events based, at least in part, on the estimated utilities of investigating the security events. The method may further include guiding the response to the security incident by presenting, to a user, data corresponding to the selected security events.
1. A method for guiding a response to a security incident, comprising:
monitoring a plurality of occurrences in a computer system,
wherein the occurrences include (1) one or more file creation or registration occurrences including a first occurrence whereby a first process creates or registers a particular file, and (2) one or more process instantiation occurrences including a second occurrence whereby the computer system instantiates a second process from the particular file and starts the second process as a service,
wherein monitoring each of the file creation or registration occurrences includes generating first relevance data indicating a relevance of (i) a respective file associated with the respective file creation or registration occurrence to (ii) a respective process that creates or registers the respective file, and
wherein monitoring each of the process instantiation occurrences includes generating second relevance data indicating a relevance of (i) a respective process associated with the respective process instantiation occurrence to (ii) a file from which the respective process is instantiated;
identifying the second process as being associated with the security incident;
determining, based on adjacency data comprising the first relevance data and the second relevance data, that at least a subset of the occurrences are relevant to the second process, wherein the subset includes the first and second occurrences;
estimating a respective utility of investigating each occurrence in the subset;
selecting two or more occurrences from the subset based, at least in part, on the estimated utilities, the selected occurrences including the first and second occurrences; and
guiding the response to the security incident by presenting, to a user, data corresponding to the selected occurrences.
2. The method of claim 1 , wherein the computer system reboots after the first occurrence and before the second occurrence.
3. The method of claim 1 , wherein the first occurrence occurs one or more days before the second occurrence.
4. The method of claim 3 , wherein the first occurrence occurs one or more weeks before the second occurrence.
5. The method of claim 1 , wherein a relevance of a respective occurrence in the subset to the second process is determined based on an extent to which activities or attributes of a computational entity associated with the respective occurrence influence activities or attributes of the second process.
6. The method of claim 1 , wherein the second occurrence is determined to be relevant to the second process based, at least in part, on the second relevance data.
7. The method of claim 6 , wherein the first occurrence is determined to be relevant to the second process based, at least in part, on the first relevance data and the second relevance data.
8. The method of claim 1 , wherein the utilities of investigating the occurrences in the subset are estimated based, at least in part, on the adjacency data.
9. The method of claim 8 , wherein the subset of the occurrences is a first subset, and wherein estimating the utilities of investigating the occurrences in the first subset comprises:
identifying a second subset of the occurrences, wherein the occurrences in the second subset are associated with the security incident;
assigning, to each of the occurrences in the second subset, a respective value representing a respective utility of investigating the respective occurrence; and
propagating the assigned values from the occurrences in the second subset to the occurrences in the first subset based on the adjacency data.
10. The method of claim 1 , further comprising ranking the selected two or more occurrences based on indicators of utility of investigating the selected two or more occurrences.
11. A system comprising:
one or more processors programmed to perform operations including:
monitoring a plurality of occurrences in a computer system,
wherein the occurrences include (1) one or more file creation or registration occurrences including a first occurrence whereby a first process creates or registers a particular file, and (2) one or more process instantiation occurrences including a second occurrence whereby the computer system instantiates a second process from the particular file and starts the second process as a service,
wherein monitoring each of the file creation or registration occurrences includes generating first relevance data indicating a relevance of (i) a respective file associated with the respective file creation or registration occurrence to (ii) a respective process that creates or registers the respective file, and
wherein monitoring each of the process instantiation occurrences includes generating second relevance data indicating a relevance of (i) a respective process associated with the respective process instantiation occurrence to (ii) a file from which the respective process is instantiated;
identifying the second process as being associated with a security incident;
determining, based on adjacency data comprising the first relevance data and the second relevance data, that at least a subset of the occurrences are relevant to the second process, wherein the subset includes the first and second occurrences;
estimating a respective utility of investigating each occurrence in the subset;
selecting two or more occurrences from the subset based, at least in part, on the estimated utilities, the selected occurrences including the first and second occurrences; and
guiding a response to the security incident by presenting, to a user, data corresponding to the selected occurrences.
12. The system of claim 11 , wherein the operations include rebooting the computer system after the first occurrence and before the second occurrence.
13. The system of claim 11 , wherein the first occurrence occurs one or more days before the second occurrence.
14. The system of claim 13 , wherein the first occurrence occurs one or more weeks before the second occurrence.
15. The system of claim 11 , wherein a relevance of a respective occurrence in the subset to the second process is determined based on an extent to which activities or attributes of a computational entity associated with the respective occurrence influence activities or attributes of the second process.
16. The system of claim 11 , wherein the second occurrence is determined to be relevant to the second process based, at least in part, on the second relevance data.
17. The system of claim 16 , wherein the first occurrence is determined to be relevant to the second process based, at least in part, on the first relevance data and the second relevance data.
18. The system of claim 11 , wherein the utilities of investigating the occurrences in the subset are estimated based, at least in part, on the adjacency data.
19. The system of claim 18 , wherein the subset of the occurrences is a first subset, and wherein estimating the utilities of investigating the occurrences in the first subset comprises:
identifying a second subset of the occurrences, wherein the occurrences in the second subset are associated with the security incident;
assigning, to each of the occurrences in the second subset, a respective value representing a respective utility of investigating the respective occurrence; and
propagating the assigned values from the occurrences in the second subset to the occurrences in the first subset based on the adjacency data.
20. A computer-readable storage device having instructions stored thereon that, when executed by one or more data processing apparatus, cause the data processing apparatus to perform operations comprising:
monitoring a plurality of occurrences in a computer system,
wherein the occurrences include (1) one or more file creation or registration occurrences including a first occurrence whereby a first process creates or registers a particular file, and (2) one or more process instantiation occurrences including a second occurrence whereby the computer system instantiates a second process from the particular file and starts the second process as a service,
wherein monitoring each of the file creation or registration occurrences includes generating first relevance data indicating a relevance of (i) a respective file associated with the respective file creation or registration occurrence to (ii) a respective process that creates or registers the respective file, and
wherein monitoring each of the process instantiation occurrences includes generating second relevance data indicating a relevance of (i) a respective process associated with the respective process instantiation occurrence to (ii) a file from which the respective process is instantiated;
identifying the second process as being associated with a security incident;
determining, based on adjacency data comprising the first relevance data and the second relevance data, that at least a subset of the occurrences are relevant to the second process, wherein the subset includes the first and second occurrences;
estimating a respective utility of investigating each occurrence in the subset;
selecting two or more occurrences from the subset based, at least in part, on the estimated utilities, the selected occurrences including the first and second occurrences; and
guiding the response to the security incident by presenting, to a user, data corresponding to the selected occurrences.