Methods and system for detecting behavioral indicators of compromise in infrastructure
A novel enterprise security solution allows for precise interception and surgical response to attack progression, in real time, as it occurs across a distributed infrastructure. The solution includes a data monitoring and management framework that continually models system level host and network activities as mutually exclusive infrastructure wide execution sequences and bucketizes them into unique execution trails. A multimodal intelligent security middleware detects indicators of compromise in real-time on top of subsets of each unique execution trail using rule based behavioral analytics, machine learning based anomaly detection, and other sources. Each detection result dynamically contributes to aggregated risk scores at execution trail level granularities. These scores can be used to prioritize and identify highest risk attack trails to end users, along with steps that such end users can perform to mitigate further damage and progression of an attack.
1. A computer-implemented method for detecting behavioral indicators of compromise in an infrastructure, the method comprising:
monitoring, by a software agent deployed on an operating system in an infrastructure, system level activities associated with the operating system;
constructing, based on the system level activities, an execution graph comprising a plurality of execution trails, wherein the execution graph comprises a plurality of nodes and a plurality of edges connecting the nodes, wherein each node represents an entity comprising a process or an artifact, wherein each edge represents an event associated with an entity, wherein each execution trail comprises a subset of the nodes and a subset of the edges, and wherein each execution trail represents a single intent or a single unit of work performed with respect to the processes and/or artifacts associated with the subset of nodes in the execution trail;
identifying one or more indicators of compromise within the execution graph based on detection results received from a plurality of sources, wherein identifying the one or more indicators of compromise comprises calculating risk scores for the execution trails and determining whether an indicator of compromise exists based on the risk scores, wherein calculating the risk scores comprises:
calculating a first risk score for a first one of the execution trails based on the entities and/or events in the first execution trail;
identifying a relationship between the first execution trail and a second one of the execution trails; and
calculating a second risk score for the second execution trail based on (1) the entities and/or events in the second execution trail and (2) the first risk score calculated for the first execution trail; and
providing to a user through a user interface a visualization of (1) the one or more indicators of compromise and (2) one or more portions of the execution graph associated with the one or more indicators of compromise.
2. The method of claim 1 , further comprising applying the detection results received from the plurality of sources to the execution graph and updating the risk scores based thereon.
3. The method of claim 1 , wherein identifying the one or more indicators of compromise comprises applying a set of rules to the execution graph, each rule comprising one or more conditional expressions that identify system level behaviors.
4. The method of claim 3 , wherein one of the rules comprises an expression to identify an event between entities represented by nodes in the execution graph.
5. The method of claim 3 , wherein one of the rules comprises an expression to identify whether an event meets a frequency threshold.
6. The method of claim 3 , wherein one of the rules comprises a plurality of expressions that identify a set of behaviors based on a subset of events occurring in one of the execution trails.
7. The method of claim 3 , wherein one of the rules comprises a plurality of expressions that identify a set of behaviors based on a subset of events occurring across a plurality of the execution trails.
8. The method of claim 1 , wherein the plurality of sources comprise (i) rule based online graph processing analytics, (ii) machine learning based anomaly detection, (iii) security events reported from host operating systems, (iv) external threat intelligence feeds, and/or (v) pre-existing silo security solutions in the infrastructure.
9. A system for detecting behavioral indicators of compromise in an infrastructure, the system comprising:
a processor; and
a non-transitory memory storing computer-executable instructions that, when executed by the processor, program the processor to perform the operations of:
monitoring, by a software agent deployed on an operating system in an infrastructure, system level activities associated with the operating system;
constructing, based on the system level activities, an execution graph comprising a plurality of execution trails, wherein the execution graph comprises a plurality of nodes and a plurality of edges connecting the nodes, wherein each node represents an entity comprising a process or an artifact, wherein each edge represents an event associated with an entity, wherein each execution trail comprises a subset of the nodes and a subset of the edges, and wherein each execution trail represents a single intent or a single unit of work performed with respect to the processes and/or artifacts associated with the subset of nodes in the execution trail;
identifying one or more indicators of compromise within the execution graph based on detection results received from a plurality of sources, wherein identifying the one or more indicators of compromise comprises calculating risk scores for the execution trails and determining whether an indicator of compromise exists based on the risk scores, wherein calculating the risk scores comprises:
calculating a first risk score for a first one of the execution trails based on the entities and/or events in the first execution trail;
identifying a relationship between the first execution trail and a second one of the execution trails; and
calculating a second risk score for the second execution trail based on (1) the entities and/or events in the second execution trail and (2) the first risk score calculated for the first execution trail; and
providing to a user through a user interface a visualization of (1) the one or more indicators of compromise and (2) one or more portions of the execution graph associated with the one or more indicators of compromise.
10. The system of claim 9 , wherein the operations further comprise applying the detection results received from the plurality of sources to the execution graph and updating the risk scores based thereon.
11. The system of claim 9 , wherein identifying the one or more indicators of compromise comprises applying a set of rules to the execution graph, each rule comprising one or more conditional expressions that identify system level behaviors.
12. The system of claim 11 , wherein one of the rules comprises an expression to identify an event between entities represented by nodes in the execution graph.
13. The system of claim 11 , wherein one of the rules comprises an expression to identify whether an event meets a frequency threshold.
14. The system of claim 11 , wherein one of the rules comprises a plurality of expressions that identify a set of behaviors based on a subset of events occurring in one of the execution trails.
15. The system of claim 11 , wherein one of the rules comprises a plurality of expressions that identify a set of behaviors based on a subset of events occurring across a plurality of the execution trails.
16. The system of claim 9 , wherein the plurality of sources comprise (i) rule based online graph processing analytics, (ii) machine learning based anomaly detection, (iii) security events reported from host operating systems, (iv) external threat intelligence feeds, and/or (v) pre-existing silo security solutions in the infrastructure.