Cloud integrated network security
Various embodiments include systems and methods pertaining to a security service platform that detects security threats based on a security service that operates on structurally deduplicated network data. The security service may operate within a cloud environment and perform the security analysis that includes compiling a ruleset to generate an executable, where the executable is run over the structurally deduplicated event data. If the executable identifies a rule match for a given portion of structurally deduplicated event data, then the security service platform may reconstruct the structurally deduplicated event data to access all portions of a network event associated with the structurally deduplicated event data that triggered the rule match. The security service platform may use the reconstructed event data to generate and provide an alert that indicates a detected cyberattack.
1. A method comprising:
accessing, by one or more cloud services, structurally deduplicated data indicative of event data, wherein the deduplicated event data is structured in accordance with a data model comprising one or more fields;
determining, based on the structurally deduplicated data, a plurality of deduplicated field groups associated with one or more fields of the data model, wherein the plurality of deduplicated field groups are associated with a network event;
determining, based on one or more references from the deduplicated field groups to a plurality of deduplicated values, one or more values associated with the deduplicated field groups;
determining, based on a ruleset running on the deduplicated field groups and on the one or more values, whether a rule is indicative of a cyberattack;
determining, based on whether the rule is indicative of a cyberattack, to reconstruct a network event or to not reconstruct the network event; and
generating, based on determining to reconstruct the network event, an alert indicative of the network event.
2. The method of claim 1 , wherein the structurally deduplicated data is indicative of multiple data formats, wherein the multiple data formats are associated with a combination of: TLS events, DNS events, or flow events.
3. The method of claim 1 , wherein the structurally deduplicated data comprises:
a plurality of event references associated with event data, wherein the event data is structured in accordance with a data model comprising one or more fields;
a plurality of deduplicated field groups associated with one or more fields of the data model that include redundant data with other field group of the event data; and
a plurality of deduplicated values associated with one or more values in one or more fields of the event data that are redundant with one or more other values in one or more other fields of the event data.
4. The method of claim 1 , wherein more than one cyberattack attempt is determined based on a single rule matching a single instance of structurally deduplicated data.
5. The method of claim 1 , further comprising:
in response to the determining to reconstruct the network event:
reconstructing, based on the structurally deduplicated data comprising deduplicated event data, an instance of a network event associated with the cyberattack; and
determining, based on the instance of the network event, the one or more remediation operations;
wherein the alert is indicative of the one or more remediation operations.
6. The method of claim 1 , wherein event data included within the structurally deduplicated data comprises: a transport layer security (TLS) event; a domain name system (DNS) event; or a flow event.
7. The method of claim 1 , wherein a quantity of levels of the deduplicated field groups is based on a quantity of nesting levels of a data model representing a network event.
8. A system comprising:
a memory storing executable instructions; and
one or more processors that execute the executable instructions to:
access, by one or more cloud services, structurally deduplicated data indicative of event data, wherein the deduplicated event data is structured in accordance with a data model comprising one or more fields;
determine, based on the structurally deduplicated data, a plurality of deduplicated field groups associated with one or more fields of the data model, wherein the plurality of deduplicated field groups are associated with a network event;
determine, based on one or more references from the deduplicated field groups to a plurality of deduplicated values, one or more values associated with the deduplicated field groups;
determine, based on a ruleset running on the deduplicated field groups and on the one or more values, whether a rule is indicative of a cyberattack;
determine, based on whether the rule is indicative of a cyberattack, to reconstruct a network event or to not reconstruct the network event; and
generate, based on determining to reconstruct the network event, an alert indicative of the network event.
9. The system of claim 8 , wherein a format of the structurally deduplicated data is based on a structure of the data model.
10. The system of claim 9 , wherein a format of the structurally deduplicated data is based on:
determining one or more references from one or more of the plurality of event references to one or more of the deduplicated field groups; and
determining one or more second references from one or more of the deduplicated field groups to one or more of the plurality of deduplicated values.
11. The system of claim 10 , wherein the structurally deduplicated data is indicative of multiple data formats, wherein the multiple data formats are associated with a combination of: TLS events, DNS events, or flow events.
12. The system of claim 8 , wherein the structurally deduplicated data comprises:
a plurality of event references associated with event data, wherein the event data is structured in accordance with a data model comprising one or more fields;
a plurality of deduplicated field groups associated with one or more fields of the data model that include redundant data with other field group of the event data; and
a plurality of deduplicated values associated with one or more values in one or more fields of the event data that are redundant with one or more other values in one or more other fields of the event data.
13. The system of claim 8 , wherein event data included within the structurally deduplicated data comprises: a transport layer security (TLS) event; a domain name system (DNS) event; or a flow event.
14. The system of claim 8 , wherein a quantity of levels of the deduplicated field groups is based on a quantity of nesting levels of a data model representing a network event.
15. One or more non-transitory computer-accessible storage media storing executable instructions that, when executed by one or more processors, cause one or more computer systems to:
access, by one or more cloud services, structurally deduplicated data indicative of event data, wherein the deduplicated event data is structured in accordance with a data model comprising one or more fields;
determine, based on the structurally deduplicated data, a plurality of deduplicated field groups associated with one or more fields of the data model, wherein the plurality of deduplicated field groups are associated with a network event;
determine, based on one or more references from the deduplicated field groups to a plurality of deduplicated values, one or more values associated with the deduplicated field groups;
determine, based on a ruleset running on the deduplicated field groups and on the one or more values, whether a rule is indicative of a cyberattack;
determine, based on whether the rule is indicative of a cyberattack, to reconstruct a network event or to not reconstruct the network event; and
generate, based on determining to reconstruct the network event, an alert indicative of the network event.
16. The one or more non-transitory computer-accessible storage media of claim 15 , wherein the structurally deduplicated data is indicative of multiple data formats, wherein the multiple data formats are associated with a combination of: TLS events, DNS events, or flow events.
17. The one or more non-transitory computer-accessible storage media of claim 16 , wherein the structurally deduplicated data comprises:
a plurality of event references associated with event data, wherein the event data is structured in accordance with a data model comprising one or more fields;
a plurality of deduplicated field groups associated with one or more fields of the data model that include redundant data with other field group of the event data; and
a plurality of deduplicated values associated with one or more values in one or more fields of the event data that are redundant with one or more other values in one or more other fields of the event data.
18. The one or more non-transitory computer-accessible storage media of claim 15 , wherein the one or more processors, further cause one or more computer systems to:
in response to the determining to reconstruct the network event:
reconstruct, based on the structurally deduplicated data comprising deduplicated event data, an instance of a network event associated with the cyberattack; and
determine, based on the instance of the network event, the one or more remediation operations;
wherein the alert is indicative of the one or more remediation operations.
19. The one or more non-transitory computer-accessible storage media of claim 15 , wherein event data included within the structurally deduplicated data comprises: a transport layer security (TLS) event; a domain name system (DNS) event; or a flow event.
20. The one or more non-transitory computer-accessible storage media of claim 15 , wherein a quantity of levels of the deduplicated field groups is based on a quantity of nesting levels of a data model representing a network event.