Methods and systems for distribution and integration of threat indicators for information handling systems
Methods and systems are provided that may be implemented in an automated manner to distribute and integrate information regarding threat indicators as they occur in real time. The provided methods and systems may be implemented to combine threat indicator characteristic information in real time with application behavior patterns, information handling system types, and/or application types; and to automatically apply the resulting intelligence together to improve malicious attack defense at the application and information handling system level at scale.
1. A method, comprising:
performing the following within a code vendor environment:
developing an executable target code,
then associating the executable target code with one or more threat indicators and/or one or more behaviors, and
then creating a data set including the executable target code and the one or more associated threat indicators and/or behaviors;
then releasing the data set from the code vendor environment by providing the data set including the executable target code and the one or more associated threat indicators and/or behaviors across a network from a first information handling system of the code vendor environment to at least one other different information handling system that comprises an endpoint information handling system or to a second information handling system that is different from each of the first information handling system and the endpoint information handling system, and that is coupled to and managing the endpoint information handling system;
then receiving the data set including the executable target code from across the network, and installing the executable target code from the data set onto the endpoint information handling system;
then executing the installed executable target code from the data set on a programmable integrated circuit of the endpoint information handling system while using the associated threat indicators and/or behaviors to detect the presence of a threat associated with the executable target code on the endpoint information handling system without taking any further action to associate the executable target code with the one or more threat indicators and/or one or more behaviors; and
then taking at least one automatic action and/or providing at least one alert only upon detection of the presence of the threat associated with the executable target code on the endpoint information handling system;
where the one or more behaviors comprise at least one of expected behaviors associated with the executable target code or unexpected behaviors associated with the executable target code.
2. The method of claim 1 , where the automatic action comprises isolating the endpoint information handling system by preventing all network traffic to and from the endpoint information handling system.
3. The method of claim 1 , where the providing the at least one alert comprises at least one of displaying a message indicating the detected presence of the detected threat or detected unexpected behavior on a display device of the endpoint information handling system or on a display device of the second information handling system managing the endpoint information handling system, or communicating a message indicating the detected presence of the detected threat or detected unexpected behavior across the network to a third information handling system that is different from each of the endpoint information handling system and the second information handling system managing the endpoint information handling system.
4. The method of claim 1 , where the threat indicators comprise at least one of known malware hashes, code that is shared on pastebins, suspicious domains, or IP addresses that are associated with malicious activity, where the behaviors comprise expected baseline behavioral patterns for the executable target code; and where the method further comprises using at least one programmable integrated circuit of the endpoint information handling system to:
use the associated threat indicators and/or behaviors to detect the presence of the threat associated with the executable target code on the endpoint information handling system; and
take the at least one automatic action and/or provide the at least one alert only upon detection of the presence of the threat associated with the executable target code on the endpoint information handling system.
5. The method of claim 1 , where the threat indicators comprising at least one of known malware hashes, code that is shared on pastebins, suspicious domains, or IP addresses that are associated with malicious activity, where the behaviors comprise expected baseline behavioral patterns for the executable target code; and where the method further comprises using at least one programmable integrated circuit of the second information handling system managing the endpoint information handling system to:
use the associated threat indicators and/or behaviors to detect the presence of the threat associated with the executable target code on the endpoint information handling system; and
take the at least one automatic action and/or provide the at least one alert only upon detection of the presence of the threat associated with the executable target code on the endpoint information handling system.
6. The method of claim 1 , further comprising performing vulnerability testing of the developed executable target code to determine the threat indicators before performing the associating of the executable target code with the one or more determined threat indicators, and before then releasing the data set from the code vendor environment by providing the data set including the executable target code and the one or more associated threat indicators and/or behaviors across the network from the first information handling system to the at least one other different information handling system.
7. The method of claim 5 , there the second information handling system managing the endpoint information handling system is coupled between the network and the endpoint information handling system.
8. The method of claim 1 , further comprising digitally signing the data set including the executable target code and the one or more associated threat indicators and/or behaviors before then releasing the data set from the code vendor environment by providing the data set across the network from the first information handling system to the at least one other information handling system; and then verifying the digitally signed data set on the at least one other information handling set as a precondition to then executing the executable target code on the programmable integrated circuit of the endpoint information handling system while using the associated threat indicators and/or behaviors to detect the presence of a threat associated with the executable target code on the endpoint information handling system.
9. The method of claim 1 , where the target code included within the data set comprises at least one of a word processing application, email application, photo editing application, Internet browser, computer game, PDF viewer, or spreadsheet application.
10. The method of claim 1 , where the executable target code is a newly developed executable target code that is developed in the code vendor environment by a code creator; where the data set including the executable target code and the one or more associated threat indicators and/or behaviors is also created by the code creator; and where the releasing the data set from the code vendor environment comprises releasing the newly developed executable target code and the one or more associated threat indicators and/or behaviors from the code creator of the code vendor environment in the data set across the network from the first information handling system to the at least one other information handling system.
11. The method of claim 1 , further comprising performing the following within the code vendor environment for the executable target code;
establishing baseline behavior patterns as the behaviors for the executable target code;
performing vulnerability testing to identify the threat indicators for the executable target code; and
then associating the executable target code with the established baseline behavior patterns of the behaviors and the identified threat indicators.
12. A system, comprising:
at least one first information handling system of a code vendor environment comprising a first programmable integrated circuit and being coupled to a first network, the first information handling system accessing a data set including an executable target code created by a code creator on the first information handling system and one or more threat indicators and/or one or more behaviors associated by the code creator with the executable target code on the first information handling system; and
at least one second information handling system different from the first information handling system, and comprising a second programmable integrated circuit and being coupled to the first network;
where the first programmable integrated circuit of the first information handling system is programmed to release the data set from the code vendor environment by providing the data set including the executable target code and the one or more associated threat indicators and/or behaviors across the first network from the first information handling system of the code vendor environment to the second information handling system;
where the second programmable integrated circuit of the second information handling system is programmed to:
use the associated threat indicators and/or behaviors from the data set to detect the presence of a threat associated with the executable target code executing on an endpoint information handling system without taking any further action to associate the executable target code with the one or more threat indicators and/or one or more behaviors, and
then take at least one automatic action and/or provide at least one alert only upon detection of the presence of the threat associated with the executable target code on the endpoint information handling system; and
where the one or more behaviors comprise at least one of expected behaviors associated with the executable target code or unexpected behaviors associated with the executable target code.
13. The system of claim 12 , where the endpoint information handling system is the second information handling system; and where the executable target code is executing on the second programmable integrated circuit of the second information handling system.
14. The system of claim 12 , where the endpoint information handling system is a third information handling system that is different from the first information handling system and the second information handling system, the third information handling system comprising a third programmable integrated circuit executing the executable target code, and the third endpoint information handling system being coupled to the second information handling system by the first network or by a second network that is different from the first network with the second information handling system managing the third information handling system across the first network or the second network.
15. The system of claim 12 , where the automatic action comprises at least one of removing the detected threat from the endpoint information handling system, isolating the detected threat by preventing network traffic only to and from the detected threat, isolating the executable target code by preventing network traffic only to and from the affected executable target code, or isolating the endpoint information handling system by preventing all network traffic to and from the endpoint information handling system.
16. The system of claim 12 , where the at least one alert comprises at least one of a displayed message indicating the detected presence of the detected threat or detected unexpected behavior on a display device of the endpoint information handling system or on a display device of an information handling system managing the endpoint information handling system, or a message indicating the detected presence of the detected threat or detected unexpected behavior that is communicated across the first network to a third information handling system that is different from the first information handling system and the second information handling system.
17. The system of claim 12 , further using at least one second programmable integrated circuit of the second information handling system to:
use the associated threat indicators and/or behaviors to detect the presence of the threat associated with the executable target code on the endpoint information handling system; and
take the at least one automatic action and/or provide the at least one alert only upon detection of the presence of the threat associated with the executable target code on the endpoint information handling system.
18. The system of claim 12 , where the first programmable integrated circuit of the first information handling system is programmed to digitally sign the data set including the executable target code and the one or more associated threat indicators and/or behaviors before then releasing the data set from the code vendor environment by providing the data set across the first network from the first information handling system of the code vendor environment to the second information handling system; and where the second programmable integrated circuit of the second information handling system is programmed to then verify the digitally signed data set as a precondition to using the associated threat indicators and/or behaviors to detect the presence of a threat associated with the executable target code executing on the endpoint information handling system.
19. The system of claim 12 , where the executable target code is associated with the one or more threat indicators and/or one or more behaviors within the data set by one or more software identification tags.
20. An information handling system, comprising a programmable integrated circuit programmed to receive a data set across a first network, the data set including an executable target code and one or more threat indicators and/or one or more behaviors associated with the executable target code; and where the programmable integrated circuit of the information handling system is further programmed to perform the following before generating or providing any alert:
use the associated threat indicators and/or behaviors from the data set to detect the presence of a threat associated with the executable target code when executing on an endpoint information handling system; and
then take at least one automatic action only upon detection of the presence of the threat associated with the executable target code when executing on the endpoint information handling system;
where the threat indicators comprise at least one of known malware hashes, code that is shared on pastebins, suspicious domains, or IP addresses that are associated with malicious activity, and where the behaviors comprise expected baseline behavioral patterns for the executable target code; and
where the at least one automatic action comprises isolating the endpoint information handling system by preventing all network traffic to and from the endpoint information handling system.
21. The information handling system of claim 20 , where the information handling system is the endpoint information handling system, and where the programmable integrated circuit of the information handling system is further programmed to:
install the executable target code from the data set onto the endpoint information handling system; and
execute the installed executable target code from the data set the programmable integrated circuit of the information handling system.
22. The information handling system of claim 20 , where the information handling system is a first information handling system different from the endpoint information handling system and the programmable integrated circuit is a first programmable integrated circuit of the first information handling system; and where the first programmable integrated circuit is programmed to manage the endpoint information handling system across the first network or a second network that is different from the first network, the endpoint information handling system being a second information handling system having a second programmable integrated circuit executing the executable target code.
23. The information handling system of claim 20 , where the executable target code is associated with the one or more threat indicators and/or one or more behaviors within the data set by one or more software identification tags.
24. The information handling system of claim 20 , where the target code included within the data set comprises at least one of a word processing application, email application, photo editing application, Internet browser, computer game, PDF viewer, or spreadsheet application.