Methods and systems for identifying infrastructure attack progressions
A novel enterprise security solution allows for precise interception and surgical response to attack progression, in real time, as it occurs across a distributed infrastructure. The solution includes a data monitoring and management framework that continually models system level host and network activities as mutually exclusive infrastructure wide execution sequences and bucketizes them into unique execution trails. A multimodal intelligent security middleware detects indicators of compromise in real-time on top of subsets of each unique execution trail using rule based behavioral analytics, machine learning based anomaly detection, and other sources. Each detection result dynamically contributes to aggregated risk scores at execution trail level granularities. These scores can be used to prioritize and identify highest risk attack trails to end users, along with steps that such end users can perform to mitigate further damage and progression of an attack.
1. A computer-implemented method for identifying infrastructure attacks, the method comprising:
providing a plurality of software agents configured to monitor system level activities, each software agent being deployed on an operating system within an infrastructure;
constructing, by each software agent, based on system level activities monitored by the software agent, an execution graph local to the operating system on which the software agent is deployed, wherein the execution graph comprises one or more local execution trails, wherein the execution graph further comprises a plurality of nodes and a plurality of edges connecting the nodes, wherein each node represents an entity comprising a process or an artifact, wherein each edge represents an event associated with an entity,
wherein constructing the execution graph comprises creating an implied edge between a first entity in the execution graph and a second entity in the execution graph upon observing that a predefined sequence of events involving the first and second entities has occurred, and
wherein observing that the predefined sequence of events involving the first and second entities has occurred comprises one of:
(i) determining that the first entity comprising a parent process has handed off, to the second entity comprising a child process, a connection accepted by the parent process, and
(ii) determining that the first entity comprising a first thread has taken over a connection accepted by the second entity comprising a second thread; and
determining a risk score for each local execution trail in the execution graphs.
2. The method of claim 1 , wherein the system level activities comprise events associated with processes, files, registries, and network connections.
3. The method of claim 1 , further comprising partitioning a particular one of the execution graphs into one or more execution trails by identifying sets of nodes and edges in the particular execution graph that each represent a single intent or single unit of work.
4. The method of claim 1 , further comprising:
receiving, at a central service, the execution graphs constructed by the software agents; and
unifying, by the central service, the received execution graphs to form one or more global execution trails, each global execution trail formed from one or more of the local execution trails in the received execution graphs.
5. The method of claim 4 , wherein each global execution trail represents a single intent or single unit of work with respect to the infrastructure.
6. The method of claim 4 , further comprising determining a risk score for each of the global execution trails, wherein the risk score for a particular one of the global execution trails is determined based on the risk scores of the local execution trails from which the particular global execution trail is formed.
7. The method of claim 6 , wherein determining the risk score for the particular global execution trail comprises combining the risk scores of the local execution trails from which the particular global execution trail is formed.
8. The method of claim 6 , further comprising providing a visualization of the global execution trails and the risk scores determined for the global execution trails.
9. The method of claim 6 , further comprising updating the risk score for the particular global execution trail upon determining that one or more risk scores of the local execution trails from which the particular global execution trail is formed have changed.
10. A system for identifying infrastructure attacks, the system comprising:
a processor; and
a memory storing computer-executable instructions that, when executed by the processor, program the processor to perform the operations of:
providing a plurality of software agents configured to monitor system level activities, each software agent being deployed on an operating system within an infrastructure;
constructing, by each software agent, based on system level activities monitored by the software agent, an execution graph local to the operating system on which the software agent is deployed, wherein the execution graph comprises one or more local execution trails, wherein the execution graph further comprises a plurality of nodes and a plurality of edges connecting the nodes, wherein each node represents an entity comprising a process or an artifact, wherein each edge represents an event associated with an entity,
wherein constructing the execution graph comprises creating an implied edge between a first entity in the execution graph and a second entity in the execution graph upon observing that a predefined sequence of events involving the first and second entities has occurred, and
wherein observing that the predefined sequence of events involving the first and second entities has occurred comprises one of:
(i) determining that the first entity comprising a parent process has handed off, to the second entity comprising a child process, a connection accepted by the parent process, and
(ii) determining that the first entity comprising a first thread has taken over a connection accepted by the second entity comprising a second thread; and
determining a risk score for each local execution trail in the execution graphs.
11. The system of claim 10 , wherein the system level activities comprise events associated with processes, files, registries, and network connections.
12. The system of claim 10 , wherein the operations further comprise partitioning a particular one of the execution graphs into one or more execution trails by identifying sets of nodes and edges in the particular execution graph that each represent a single intent or single unit of work.
13. The system of claim 10 , wherein the operations further comprise:
receiving, at a central service, the execution graphs constructed by the software agents; and
unifying, by the central service, the received execution graphs to form one or more global execution trails, each global execution trail formed from one or more of the local execution trails in the received execution graphs.
14. The system of claim 13 , wherein each global execution trail represents a single intent or single unit of work with respect to the infrastructure.
15. The system of claim 13 , wherein the operations further comprise determining a risk score for each of the global execution trails, wherein the risk score for a particular one of the global execution trails is determined based on the risk scores of the local execution trails from which the particular global execution trail is formed.
16. The system of claim 15 , wherein determining the risk score for the particular global execution trail comprises combining the risk scores of the local execution trails from which the particular global execution trail is formed.
17. The system of claim 15 , wherein the operations further comprise providing a visualization of the global execution trails and the risk scores determined for the global execution trails.
18. The system of claim 15 , wherein the operations further comprise updating the risk score for the particular global execution trail upon determining that one or more risk scores of the local execution trails from which the particular global execution trail is formed have changed.