Graph-based multi-staged attack detection in the context of an attack framework

1. A method, performed by a computer system, for graph-based, multi-stage attack detection in which cybersecurity alerts are displayed based on attack tactics in an attack framework, the method comprising:

obtaining a plurality of cybersecurity alerts (“alerts”) generated in an analysis window;

classifying each of the alerts with an attack tactic based on the attack framework having a sequence of attack tactics;

grouping the alerts into tactic blocks, wherein each tactic block satisfies an alert grouping criteria including having a same attack tactic and falling within a time window, wherein the time window is within the analysis window, and wherein each tactic block is associated with a start time based on a start timestamp of a first alert in the tactic block and an end time based on an end timestamp of a last alert in the tactic block;

constructing a graph of tactic blocks by directionally connecting blocks based on a time criteria, a tactic criteria, and a matching criteria, wherein the time criteria for directionally connecting a first tactic block to a second tactic block is satisfied in response to the first tactic block having an earlier start time than a second tactic block and in response to the end time of the first tactic block being within P hours of the start time of the second tactic block, and wherein the tactic criteria is satisfied for directionally connecting the first tactic block to the second tactic block in response to the tactic associated with the first tactic block being the same or preceding the tactic associated with the second tactic block in the attack framework;

identifying one or more clusters of interconnected components in the graph of tactic blocks;

for each of the clusters, identifying a threat scenario comprising a sequence of attack tactics in the attack framework;

ranking the threat scenarios; and

displaying information for n highest ranked threat scenarios, wherein n is a positive integer, and wherein the information displayed for said threat scenarios includes a sequence of attack tactics associated with the threat scenario.

2. The method of claim 1 , wherein the matching criteria for directionally connecting the first tactic block to the second tactic block is satisfied in response to the first and second tactic blocks satisfying one or more of the following:

(a) the first and second tactic blocks are associated with the same user name;

(b) the first and second tactic blocks share the same source host computer; or

(c) any of the first tactic block destination host computers matches the second tactic block's source host computer.

3. The method of claim 1 , wherein identifying the one or more clusters comprises identifying one or more connected components using a connected component algorithm in graph theory.

4. The method of claim 1 , wherein, for each of the clusters, identifying the threat scenario comprises identifying a path that represents the highest-risk sequence of events in the cluster.

5. The method of claim 4 , wherein, each alert is associated with a risk score, and the path representing the highest-risk sequence of events is identified based on risk scores associated each type of alert in the path.

6. The method of claim 5 , wherein the threat scenarios are ranked as a function of the risk scores associated with the threat scenarios.

7. The method of claim 1 , wherein the sequence of attack tactics displayed is based on the sequence of tactic blocks in the threat scenario.

8. A non-transitory computer-readable medium comprising a computer program, that, when executed by a computer system, enables the computer system to perform the following method for graph-based, multi-stage attack detection in which cybersecurity alerts are displayed based on attack tactics in an attack framework, the method comprising:

obtaining a plurality of cybersecurity alerts (“alerts”) generated in an analysis window;

classifying each of the alerts with an attack tactic based on the attack framework having a sequence of attack tactics;

grouping the alerts into tactic blocks, wherein each tactic block satisfies an alert grouping criteria including having a same attack tactic and falling within a time window, wherein the time window is within the analysis window, and wherein each tactic block is associated with a start time based on a start timestamp of a first alert in the tactic block and an end time based on an end timestamp of a last alert in the tactic block;

constructing a graph of tactic blocks by directionally connecting blocks based on a time criteria, a tactic criteria, and a matching criteria, wherein the time criteria for directionally connecting a first tactic block to a second tactic block is satisfied in response to the first tactic block having an earlier start time than a second tactic block and in response to the end time of the first tactic block being within P hours of the start time of the second tactic block, and wherein the tactic criteria is satisfied for directionally connecting the first tactic block to the second tactic block in response to the tactic associated with the first tactic block being the same or preceding the tactic associated with the second tactic block in the attack framework;

identifying one or more clusters of interconnected components in the graph of tactic blocks;

for each of the clusters, identifying a threat scenario comprising a sequence of attack tactics in the attack framework;

ranking the threat scenarios; and

displaying information for n highest ranked threat scenarios, wherein n is a positive integer, wherein the information displayed for said threat scenarios includes a sequence of attack tactics associated with the threat scenario.

9. The non-transitory computer-readable medium of claim 8 , wherein the matching criteria for directionally connecting the first tactic block to the second tactic block is satisfied in response to the first and second tactic blocks satisfying one or more of the following:

(a) the first and second tactic blocks are associated with the same user name;

(b) the first and second tactic blocks share the same source host computer; or

(c) any of the first tactic block destination host computers matches the second tactic block's source host computer.

10. The non-transitory computer-readable medium of claim 8 , wherein identifying the one or more clusters comprises identifying one or more connected components using a connected component algorithm in graph theory.

11. The non-transitory computer-readable medium of claim 8 , wherein, for each of the clusters, identifying the threat scenario comprises identifying a path that represents the highest-risk sequence of events in the cluster.

12. The non-transitory computer-readable medium of claim 11 , wherein, each alert is associated with a risk score, and the path representing the highest-risk sequence of events is identified based on risk scores associated each type of alert in the path.

13. The non-transitory computer-readable medium of claim 12 , wherein the threat scenarios are ranked as a function of the risk scores associated with the threat scenarios.

14. The non-transitory computer-readable medium of claim 8 , wherein the sequence of attack tactics displayed is based on the sequence of tactic blocks in the threat scenario.

15. A computer system for graph-based, multi-stage attack detection in which cybersecurity alerts are displayed based on attack tactics in an attack framework, the system comprising:

one or more processors;

one or more memory units coupled to the one or more processors, wherein the one or more memory units store instructions that, when executed by the one or more processors, cause the system to perform the operations of:

obtaining a plurality of cybersecurity alerts (“alerts”) generated in an analysis window;

classifying each of the alerts with an attack tactic based on the attack framework having a sequence of attack tactics;

grouping the alerts into tactic blocks, wherein each tactic block satisfies an alert grouping criteria including having a same attack tactic and falling within a time window, wherein the time window is within the analysis window, and wherein each tactic block is associated with a start time based on a start timestamp of a first alert in the tactic block and an end time based on an end timestamp of a last alert in the tactic block;

constructing a graph of tactic blocks by directionally connecting blocks based on a time criteria, a tactic criteria, and a matching criteria, wherein the time criteria for directionally connecting a first tactic block to a second tactic block is satisfied in response to the first tactic block having an earlier start time than a second tactic block and in response to the end time of the first tactic block being within P hours of the start time of the second tactic block, and wherein the tactic criteria is satisfied for directionally connecting the first tactic block to the second tactic block in response to the tactic associated with the first tactic block being the same or preceding the tactic associated with the second tactic block in the attack framework;

identifying one or more clusters of interconnected components in the graph of tactic blocks;

for each of the clusters, identifying a threat scenario comprising a sequence of attack tactics in the attack framework;

ranking the threat scenarios; and

displaying information for n highest ranked threat scenarios, wherein n is a positive integer, wherein the information displayed for said threat scenarios includes a sequence of attack tactics associated with the threat scenario.

16. The system of claim 15 , wherein, for each of the clusters, identifying the threat scenario comprises identifying a path that represents the highest-risk sequence of events in the cluster.