Cyber defense system
In one aspect, a computer-implemented method of detecting network security threats comprises the following steps: receiving at an analysis engine events relating to a monitored network; analysing the received events to identify at least one event that meets a case creation condition and, in response, creating a case in an experience database, the case being populated with data of the identified at least one event; assigning a threat score to the created case based on the event data; matching at least one further event to the created case and populating the case with data of the at least one further event, the threat score assigned to that case being updated in response; and in response to the threat score for one of the cases meeting a significance condition, rendering that case accessible via a case interface.
1. A method of detecting security threats, the method comprising: receiving, at a data processing system, events relating to a monitored network, the events comprising (i) network events generated by monitoring network traffic within the network, and (ii) endpoint events generated using endpoint agents executed on endpoints of the monitored network to monitor local activity at those endpoints, wherein each of the network and endpoint events comprises: (i) event description data, (ii) an associated timestamp, and (iii) one or more related entity identifiers;
processing the network and endpoint events to link each of at least some of the endpoint events to at least one of the network events, based on the timestamps and the entity identifiers in those events; and
analysing the events to detect security threat conditions indicated by the events, wherein at least one security threat condition is detected based on an endpoint event and a network event to which the endpoint event has been linked, wherein the analysis comprises creating, in an experience database, cases in response to the events, wherein at least some of the events are linked together by associating them with a common case.
2. The method according to claim 1 , wherein at least some of the events are linked by joining the events together, in a joining phase performed prior to the analysis.
3. The method according to claim 1 , wherein the case is populated with data of the events associated with it.
4. The method according to claim 1 , wherein each case is assigned a threat score, the security threat conditions being detected based on the threat scores.
5. The method according to claim 1 , comprising standardizing the events according to a predetermined data model.
6. The method according to claim 1 , wherein the one or more related entity identifiers comprise one or more of: a network address, a user identifier, a device identifier, and an identifier of a process.
7. The method according to claim 1 , wherein at least one of the endpoint events is linked to at least one of the network events based on respective network connection identifiers in those events.
8. The method according to claim 7 , wherein the event description data of the at least one endpoint event associates at least one of the following with the network connection identifier: a socket on the endpoint, a host name of the endpoint, a process running on the endpoint, and a user account on the endpoint, which is thereby linked to the at least one network event.
9. The method according to claim 8 , wherein the event description data of the endpoint event is thereby linked to the event description data of the network event, which denotes network activity associated with the identified network connection.
10. The method according to claim 7 , wherein each of those events comprises multiple entity identifiers, which constitute the network connection identifier.
11. The method according to claim 10 , wherein the multiple entity identifiers are in the form of a five-tuple formed of: a source IP address, a source port, a destination IP address, a destination port and a transport protocol.
12. The method according to claim 10 , comprising hashing the multiple entity identifiers in the events to create respective identifier hashes, wherein the events are linked based on the identifier hashes.
13. A data processing system comprising:
least one input configured to receive events relating to a monitored network, the events comprising (i) network events generated by monitoring network traffic within the network, and (ii) endpoint events generated using endpoint agents executed on endpoints of the monitored network to monitor local activity at those endpoints, wherein each of the network and endpoint events comprises: (i) event description data, (ii) an associated timestamp, and (iii) one or more related entity identifiers at least one memory configured to store computer-readable instructions;
at least one hardware processor coupled to the at least one memory and configured to execute the computer-readable instructions, which upon execution cause the at least one hardware processor to:
process the network and endpoint events to link each of at least some of the endpoint events to at least one of the network events, based on the timestamps and the entity identifiers in those events; and
analyse the events to detect security threat conditions indicated by the events, wherein at least one security threat condition is detected based on an endpoint event and a network event to which the endpoint event has been linked, wherein at least one of the endpoint events is linked to at least one of the network events based on respective network connection identifiers in those events, the network connection identifier being a five-tuple formed of: a source IP address, a source port, a destination IP address, a destination port and a transport protocol.
14. The data processing system of claim 13 , wherein the one or more processors are configured to link at least some of the events by joining the events together, in a joining phase performed prior to the analysis.
15. The data processing system of claim 13 , wherein the analysis comprises creating, in an experience database, cases in response to the events, wherein at least some of the events are linked together by associating them with a common case.
16. The data processing system of claim 15 , wherein the one or more processors are configured to populate the case with data of the events associated with it.
17. The data processing system of claim 15 , wherein the one or more processors are configured to assign each case a threat score, the security threat conditions being detected based on the threat scores.
18. The data processing system of claim 13 , wherein the one or more processors are configured to standardize the events according to a predetermined data model.
19. One or more non-transitory computer-readable media comprising instructions that, when executed on one or more processors, cause the one or more processors to:
receive events relating to a monitored network, the events comprising (i) network events generated by monitoring network traffic within the network, and (ii) endpoint events generated using endpoint agents executed on endpoints of the monitored network to monitor local activity at those endpoints, wherein each of the network and endpoint events comprises: (i) event description data, (ii) an associated timestamp, and (iii) one or more related entity identifiers;
process the network and endpoint events to link each of at least some of the endpoint events to at least one of the network events, based on the timestamps and the entity identifiers in those events; and
analyse the events to detect security threat conditions indicated by the events, wherein at least one security threat condition is detected based on an endpoint event and a network event to which the endpoint event has been linked, wherein at least one of the endpoint events is linked to at least one of the network events based on respective network connection identifiers in those events, wherein each of those events comprises multiple entity identifiers, which constitute the network connection identifier, the instructions causing the one or more processors to hash ng the multiple entity identifiers in the events to create respective identifier hashes, wherein the events are linked based on the identifier hashes.