Classification of cyber-alerts into security incidents
Methods, apparatuses and computer program products that implement embodiments of the present invention for protecting a computer network, include receiving, in a security server, alerts of multiple different types, indicative of potentially malicious activity in the network, that are detected by multiple different protection appliances deployed in the network. The alerts in the security server are correlated so as to identify a first alert of a first type from a first protection appliance in the network and a second alert of a second type, different from the first type from a second protection appliance in the network that are together indicative of a single attack on the network. Finally, a consolidated alert is issued responsively to the attack.
1. A method for protecting a computer network in which multiple computing devices execute respective pluralities of processes, the method comprising:
receiving, in a security server, alerts of multiple different types, indicative of potentially malicious activity in the computer network, that are detected by multiple different protection appliances deployed in the computer network;
identifying respective causality profiles for the processes that gave rise to the alerts received by the security server;
correlating the alerts in the security server using the respective causality profiles so as to identify a first alert of a first type received with respect to a first process from a first protection appliance in the computer network and a second alert of a second type, different from the first type, received with respect to a second process from a second protection appliance in the computer network that are together indicative of a single attack on the computer network; and
issuing a consolidated alert responsively to the single attack.
2. The method according to claim 1 , wherein receiving the first alert comprises receiving the first alert at a first time, and wherein receiving the second alert comprises receiving the second alert at a second time subsequent to the first time, wherein the first and the second times are within a specified time period.
3. The method according to claim 1 , wherein identifying the respective causality profiles comprises identifying respective causality group owners (CGOs) for the processes that gave rise to the alerts, and wherein correlating the alerts comprises detecting that the CGO for the first process matches the CGO for the second process.
4. The method according to claim 1 , wherein identifying the respective causality profiles comprises identifying respective execution chains for the processes that gave rise to the alerts, wherein each of the processes that gave rise to the alerts comprises an endpoint for its respective execution chain, and wherein correlating the alerts comprises detecting that the execution chain for the first process matches the execution chain for the second process.
5. The method according to claim 1 , wherein identifying the respective causality profiles comprises computing respective parent hashes for the processes that gave rise to the alerts, wherein each given alert comprises a given process and its respective parent hash, and wherein correlating the alerts comprises detecting that the parent hash for the first alert matches the parent hash for the second alert.
6. The method according to claim 1 , wherein correlating the alerts comprises detecting that the first alert indicates a first given computing device conveying a first transmission to an Internet site suspected of being malicious, and detecting that the second alert indicates a second given computing device conveying a second transmission to the Internet site.
7. The method according to claim 1 , wherein correlating the alerts comprises detecting that the first alert indicates a first given computing device storing a file suspected of being malicious, and detecting that the second alert indicates a second computing device storing an identical copy of the file.
8. The method according to claim 1 , wherein each given protection appliance is selected from a group consisting of a firewall, a software application executing on a given computing device, a data cloud firewall and a data cloud security software application.
9. An apparatus for protecting a computer network in which multiple computing devices execute respective pluralities of processes, the apparatus comprising:
a network interface card (NIC); and
at least one processor configured:
to receive alerts of multiple different types, indicative of potentially malicious activity in the computer network, that are detected by multiple different protection appliances deployed in the computer network,
to identify respective causality profiles for the processes that gave rise to the alerts received by the security server,
to correlate the alerts in the security server using the respective causality profiles so as to identify a first alert of a first type received with respect to a first process from a first protection appliance in the computer network and a second alert of a second type, different from the first type, received with respect to a second process from a second protection appliance in the computer network that are together indicative of a single attack on the computer network, and
to issue a consolidated alert responsively to the single attack.
10. The apparatus according to claim 9 , wherein a given processor is configured to receive the first alert by receiving the first alert at a first time, and wherein the given processor is configured to receiving the second alert by receiving the second alert at a second time subsequent to the first time, wherein the first and the second times are within a specified time period.
11. The apparatus according to claim 9 , wherein the respective causality profiles comprise respective causality group owners (CGOs) for the processes that gave rise to the alerts, and wherein the at least one processor is configured to correlate the alerts by detecting that the CGO for the first process matches the CGO for the second process.
12. The apparatus according to claim 9 , wherein the respective causality profiles comprise respective execution chains for the processes that gave rise to the alerts, wherein each of the processes that gave rise to the alerts comprises an endpoint for its respective execution chain, and wherein the at least one processor is configured to correlate the alerts by detecting that the execution chain for the first process matches the execution chain for the second process.
13. The apparatus according to claim 9 , wherein the respective causality profiles comprise respective parent hashes for the processes that gave rise to the alerts, wherein each given alert comprises a given process and its respective parent hash, and wherein the at least one processor is configured to correlate the alerts by detecting that the parent hash for the first alert matches the parent hash for the second alert.
14. The apparatus according to claim 9 , wherein a given processor is configured to correlate the alerts by detecting that the first alert indicates a first given computing device conveying a first transmission to an Internet site suspected of being malicious, and by detecting that the second alert indicates a second given computing device conveying a second transmission to the Internet site.
15. The apparatus according to claim 9 , wherein a given processor is configured to correlate the alerts by detecting that the first alert indicates a first given computing device storing a file suspected of being malicious, and by detecting that the second alert indicates a second computing device storing an identical copy of the file.
16. The apparatus according to claim 9 , wherein each given protection appliance is selected from a group consisting of a firewall, a software application executing on a given computing device, a data cloud firewall and a data cloud security software application.
17. A computer software product for protecting a computer network in which multiple computing devices execute respective pluralities of processes, the product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:
to receive alerts of multiple different types, indicative of potentially malicious activity in the computer network, that are detected by multiple different protection appliances deployed in the computer network;
to identify respective causality profiles for the processes that gave rise to the alerts received by the security server;
to correlate the alerts in the security server using the respective causality profiles so as to identify a first alert of a first type received with respect to a first process from a first protection appliance in the computer network and a second alert of a second type, different from the first type, received with respect to a second process from a second protection appliance in the computer network that are together indicative of a single attack on the computer network; and
to issue a consolidated alert responsively to the single attack.