Cyberattack identification in a network environment
There is provided mechanisms for cyberattack identification in a network environment. A method is performed by a security analytics module. The method comprises obtaining logged events. The events having occurred and are logged in the network environment. Each logged event is associated with a cyber security deviation score and cyber security deviation statistics. The method comprises matching each logged event to a cyber-attack lifecycle phase by comparing characteristics of each logged event, as given by the cyber security deviation statistics, to known cyberattack lifecycle phases. The method comprises linking together the logged events by forming at least one chain of the logged events. Each chain corresponds to one type of cyberattack as given by combinations of the known cyberattack lifecycle phases. The cyber security deviation scores and cyber security deviation statistics are updated based on how the logged events are linked together. The method comprises determining, based on how the logged events are linked together and the cyber security deviation scores and the cyber security deviation statistics as updated, whether the logged events are benign or part of a cyberattack.
1. A method for cyberattack identification in a network environment, the method being performed by a security analytics module, the method comprising:
obtaining logged events, the events having occurred and being logged in the network environment, wherein each logged event is associated with a cyber security deviation score and cyber security deviation statistics;
matching each logged event to a cyberattack lifecycle phase by comparing characteristics of each logged event, as given by the cyber security deviation statistics, to known cyberattack lifecycle phases;
linking together the logged events by forming at least one chain of the logged events where each vertex represents one logged event and where each edge represents a probability value, wherein each chain corresponds to one type of cyberattack as given by combinations of the known cyberattack lifecycle phases, wherein the cyber security deviation scores and cyber security deviation statistics are updated based on how the logged events are linked together; and
determining, based on how the logged events are linked together and the cyber security deviation scores and the cyber security deviation statistics are updated, whether the logged events are benign or part of a cyberattack,
wherein the security deviation statistics for each logged event is defined as standard deviation of the cyber security deviation score for the same event.
2. The method according to claim 1 , wherein all logged events are of a uniform machine-readable format.
3. The method according to claim 1 , wherein the security deviation score for each logged event is proportional to a probability of that event being part of the cyberattack.
4. The method according to claim 1 , wherein said comparing involves selecting the cyberattack lifecycle phase that best matches a combination of event type, cyber security deviation score, and cyber security deviation statistics for each logged event.
5. The method according to claim 1 , further comprising;
obtaining a probability score for each logged event to be part of the cyberattack, and wherein said matching is based on the cyber security deviation statistics for each logged event.
6. The method according to claim 5 , wherein the probability score per logged event is based on one or more of host data, network data, connection direction, protocol, number of connections, and failed login attempts, associated with that logged event.
7. The method according to claim 5 , wherein each event, based on the probability score for that logged event, is flagged as malicious or benign, and wherein said matching is dependent on which logged events are flagged as malicious and which logged events are flagged as benign.
8. The method according to claim 1 , wherein the logged events are linked together according to an ordered sequence of occurrence of the events, and wherein the ordered sequence is given by one combination of the known cyberattack lifecycle phases.
9. The method according to claim 8 , wherein said one combination of the known cyberattack lifecycle phases is based on a set of cyberattack lifecycle templates, where each cyberattack lifecycle template comprises its own unique order of occurrence and characteristics of the known cyberattack lifecycle phases.
10. The method according to claim 1 , wherein, during said linking, each logged event is provided with a cyberattack lifecycle label.
11. The method according to claim 5 , wherein the probability score, the cyber security deviation scores and cyber security deviation statistics for each logged event are updated based on which type of other logged events and their cyber security deviation scores and cyber security deviation statistics that are linked to that logged event.
12. The method according to claim 11 , further comprising:
determining, based on how the logged events are linked together and the probability score and the cyber security deviation scores and the cyber security deviation statistics as updated, whether the logged events belong to one and the same attacker or not.
13. The method according to claim 1 , further comprising:
predicting, based on how the logged events are linked together and the cyber security deviation scores and the cyber security deviation statistics as updated, further events to be logged as part of the cyberattack.
14. The method according to claim 13 , further comprising:
determining, based on which events that have been predicted to be logged as part of the cyberattack, at least one cyberattack mitigation action to take.
15. The method according to claim 9 , wherein, when there is no exact match between the combination of the known cyberattack lifecycle phases and any of the cyberattack lifecycle templates, the cyberattack is identified as a new type of cyberattack.
16. A security analytics module for cyberattack identification in a network environment, the security analytics module comprising processing circuitry, the processing circuitry being configured to cause the security analytics module to:
obtain logged events, the events having occurred and being logged in the network environment, wherein each logged event is associated with a cyber security deviation score and cyber security deviation statistics;
match each logged event to a cyberattack lifecycle phase by comparing characteristics of each logged event, as given by the cyber security deviation statistics, to known cyberattack lifecycle phases;
link together the logged events by forming at least one chain of the logged events where each vertex represents one logged event and where each edge represents a probability value, wherein each chain corresponds to one type of cyberattack as given by combinations of the known cyberattack lifecycle phases, wherein the cyber security deviation scores and cyber security deviation statistics are updated based on how the logged events are linked together; and
determine, based on how the logged events are linked together and the cyber security deviation scores and the cyber security deviation statistics are updated, whether the logged events are benign or part of a cyberattack,
wherein the security deviation statistics for each logged event is defined as standard deviation of the cyber security deviation score for the same event.
17. The security analytics module according to claim 16 , further being configured to obtain a probability score for each logged event to be part of the cyberattack, and wherein said matching is based on the cyber security deviation statistics for each logged event.
18. A computer program product comprising a computer program for cyberattack identification in a network environment, and a non-transitory computer readable storage medium on which the computer program is stored, and where the computer program comprises computer code which, when run on processing circuitry of a security analytics module, causes the security analytics module to:
obtain logged events, the events having occurred and being logged in the network environment, wherein each logged event is associated with a cyber security deviation score and cyber security deviation statistics;
match each logged event to a cyberattack lifecycle phase by comparing characteristics of each logged event, as given by the cyber security deviation statistics, to known cyberattack lifecycle phases;
link together the logged events by forming at least one chain of the logged events where each vertex represents one logged event and where each edge represents a probability value, wherein each chain corresponds to one type of cyberattack as given by combinations of the known cyberattack lifecycle phases, wherein the cyber security deviation scores and cyber security deviation statistics are updated based on how the logged events are linked together; and
determine, based on how the logged events are linked together and the cyber security deviation scores and the cyber security deviation statistics are updated, whether the logged events are benign or part of a cyberattack,
wherein the security deviation statistics for each logged event is defined as standard deviation of the cyber security deviation score for the same event.
19. The security analytics module according to claim 16 , being configured to predict, based on how the logged events are linked together and the cyber security deviation scores and the cyber security deviation statistics as updated, further events to be logged as part of the cyberattack.