Apparatus and method for monitoring of data for attack detection and prevention
A stream of cybersecurity alerts is received. Each cybersecurity alert from the stream of cybersecurity alerts is associated with a set of attributes. Each cybersecurity alert from the stream of cybersecurity alerts is associated, based on the set of attributes and as that cybersecurity alert is received, to a bucket from a set of buckets. Each bucket from the set of buckets is associated with (1) an attribute from the set of attributes different than remaining buckets from the set of buckets and (2) a set cybersecurity alerts from the stream of cybersecurity alerts having the attribute. For each bucket from the set of buckets, a set of correlations between cybersecurity alerts included in the set of cybersecurity alerts for that bucket are determined, based on the set of cybersecurity alerts for that bucket, to generate an attack graph associated with that bucket.
1. A non-transitory processor-readable medium storing code representing instructions to be executed by one or more processors, the instructions comprising code to cause the one or more processors to:
receive a cybersecurity alert associated with an attribute;
identify a bucket associated with a set of cybersecurity alerts that includes the cybersecurity alert;
update the set of cybersecurity alerts associated with the bucket from a hash table and associated with the attribute of the cybersecurity alert to generate an updated set of cybersecurity alerts that is associated with the bucket and that includes the cybersecurity alert and the set of cybersecurity alerts;
identify a set of correlations between cybersecurity alerts included in the updated set of cybersecurity alerts associated with the bucket;
determine a maliciousness score associated with a first attack subgraph from an attack graph that is based on the set of correlations;
determine a maliciousness score associated with a second attack subgraph from the attack graph; and
in response to at least one of the maliciousness score associated with the first attack subgraph or the maliciousness score associated with the second attack subgraph being outside a predetermined maliciousness score range, send a signal to cause at least one remedial action.
2. The non-transitory processor-readable medium of claim 1 , wherein the cybersecurity alert is a first cybersecurity alert, the first cybersecurity alert is received at a first time, the attribute is a first attribute, the bucket is a first bucket, the set of correlations is a first set of correlations, the attack graph is a first attack graph, the signal is a first signal, the at least one remedial action is at least one first remedial action, and the instructions further comprising code to cause the one or more processors to:
receive a second cybersecurity alert at a second time after the first time, the second cybersecurity alert associated with a second attribute different than the first attribute;
update a set of cybersecurity alerts associated with a second bucket from the hash table to generate an updated set of cybersecurity alerts that is associated with the second bucket and that includes the second cybersecurity alert;
identify a second set of correlations between cybersecurity alerts included in the updated set of cybersecurity alerts associated with the second bucket;
determine a maliciousness score associated with a third attack subgraph from a second attack graph that is based on the second set of correlations;
determine a maliciousness score associated with a fourth attack subgraph from the second attack graph; and
in response to at least one of the maliciousness score associated with the third attack subgraph or the maliciousness score associated with the fourth attack subgraph being outside the predetermined maliciousness score range, send a second signal to cause at least one second remedial action.
3. The non-transitory processor-readable medium of claim 1 , wherein the cybersecurity alert is a first cybersecurity alert, the first cybersecurity alert is received at a first time, the set of correlations is a first set of correlations, the attack graph is a first attack graph, the signal is a first signal, the at least one remedial action is at least one first remedial action, and the instructions further comprising code to cause the one or more processors to:
receive a second cybersecurity alert at a second time after the first time, the second cybersecurity alert associated with the attribute;
update, automatically in response to receiving the second cybersecurity alert, the updated set of cybersecurity alerts associated with the bucket to generate a further updated set of cybersecurity alerts associated with the bucket, the updated set of cybersecurity alerts associated with the bucket not including the second cybersecurity alert, the further updated set of cybersecurity alerts associated with the bucket including the second cybersecurity alert;
identify a second set of correlations between cybersecurity alerts included in the further updated set of cybersecurity alerts associated with the bucket;
determine a maliciousness score associated with a third attack subgraph from a second attack graph that is based on the second set of correlations;
determine a maliciousness score associated with a fourth attack subgraph from the second attack graph; and
in response to at least one of the maliciousness score associated with the third attack subgraph or the maliciousness score associated with the fourth attack subgraph being outside the predetermined maliciousness score range, send a second signal to cause at least one second remedial action.
4. The non-transitory processor-readable medium of claim 1 , wherein the cybersecurity alert is a first cybersecurity alert, the first cybersecurity alert is received at a first time, the attribute is a first attribute, the bucket is a first bucket, the hash table is a first hash table, the set of correlations is a first set of correlations, the attack graph is a first attack graph, the signal is a first signal, the at least one remedial action is at least one first remedial action, and the instructions further comprising code to cause the one or more processors to:
receive a second cybersecurity alert at a second time after the first time, the second cybersecurity alert associated with a second attribute different than the first attribute;
update a set of cybersecurity alerts associated with a second bucket from a second hash table associated with the second attribute and different from the first hash table, to generate an updated set of cybersecurity alerts that is associated with the second bucket and that includes the second cybersecurity alert;
identify a second set of correlations between cybersecurity alerts included in the updated set of cybersecurity alerts associated with the second bucket;
determine a maliciousness score associated with a third attack subgraph from a second attack graph that is based on the second set of correlations;
determine a maliciousness score associated with a fourth attack subgraph from the second attack graph; and
in response to at least one of the maliciousness score associated with the third attack subgraph or the maliciousness score associated with the fourth attack subgraph being outside the predetermined maliciousness score range, send a second signal to cause at least one second remedial action.
5. The non-transitory processor-readable medium of claim 1 , wherein the attribute is a first attribute, the cybersecurity alert is further associated with a second attribute different than the first attribute, the hash table is a first hash table, the set of correlations is a first set of correlations, the attack graph is a first attack graph, the signal is a first signal, the at least one remedial action is at least one first remedial action, and the instructions further comprising code to cause the one or more processors to:
update a set of cybersecurity alerts associated with a bucket from a second hash table associated with the second attribute and different from the first hash table, to generate an updated set of cybersecurity alerts that is associated with the bucket from the second hash table and that includes the cybersecurity alert;
identify a second set of correlations between pairs of cybersecurity alerts included in the updated set of cybersecurity alerts associated with the bucket from the second hash table;
determine a maliciousness score associated with a third attack subgraph from a second attack graph that is based on the second set of correlations;
determine a maliciousness score associated with a fourth attack subgraph from the second attack graph; and
in response to at least one of the maliciousness score associated with the third attack subgraph or the maliciousness score associated with the fourth attack subgraph being outside the predetermined maliciousness score range, send a second signal to cause at least one second remedial action.
6. The non-transitory processor-readable medium of claim 1 , wherein the first attack subgraph from the attack graph is identified using a linear greedy approach.
7. The non-transitory processor-readable medium of claim 1 , wherein the code to update the set of cybersecurity alerts associated with the bucket to generate the updated set of cybersecurity alerts associated with the bucket includes code to cause the updated set of cybersecurity alerts associated with the bucket to include a count of cybersecurity alerts greater than a predetermined threshold, the instructions further comprising code to cause the one or more processors to:
delete at least one cybersecurity alert included in the updated set of cybersecurity alerts associated with the bucket such that the count of cybersecurity alerts is less than the predetermined threshold.
8. The non-transitory processor-readable medium of claim 1 , the instructions further comprising code to cause the one or more processors to:
update, at a predetermined period of time after the cybersecurity alert has been received, the updated set of cybersecurity alerts associated with the bucket to generate a modified updated set of cybersecurity alerts associated with the bucket, the modified updated set of cybersecurity alerts associated with the bucket not including the cybersecurity alert.
9. The non-transitory processor-readable medium of claim 1 , wherein the hash table is a first hash table and the cybersecurity alert is a first cybersecurity alert, the instructions further comprising code to cause the one or more processors to:
receive a second cybersecurity alert;
determine, in response to receiving the second cybersecurity alert, an identifier associated with the second cybersecurity alert;
determine that the identifier is not included in a second hash table; and
store a representation of the identifier in the second hash table.
10. The non-transitory processor-readable medium of claim 1 , wherein the hash table is a first hash table and the cybersecurity alert is a first cybersecurity alert, the instructions further comprising code to cause the one or more processors to:
receive a second cybersecurity alert;
determine, in response to receiving the second cybersecurity alert, an identifier associated with the second cybersecurity alert;
determine, using the identifier, that the second cybersecurity alert is included in a bucket of a second hash table, the bucket of the second hash table associated with a third cybersecurity alert; and
merge information associated with the second cybersecurity alert with information associated with the third cybersecurity alert to generate merged cybersecurity alert information that is associated with the bucket of the second hash table.
11. An apparatus, comprising:
a memory; and
a processor operatively coupled to the memory, the processor configured to:
for each cybersecurity alert from a stream of cybersecurity alerts:
identify a bucket associated with that cybersecurity alert, the bucket uniquely associated with an attribute, the cybersecurity alert associated with the attribute, the bucket associated with a set of cybersecurity alerts that includes that cybersecurity alert, and
determine, based on the set of cybersecurity alerts, a set of correlations between cybersecurity alerts included in the set of cybersecurity alerts to update an attack graph associated with the set of cybersecurity alerts,
identify a set of attack subgraphs from the attack graph based on a linear greedy approach; and
in response to a maliciousness score for an attack subgraph from the set of attack subgraphs being outside a predetermined maliciousness score range, send a signal to cause at least one remedial action.
12. The apparatus of claim 11 , wherein the bucket is a first bucket, the attribute is a first attribute, the set of cybersecurity alerts is a first set of cybersecurity alerts, the set of correlations is a first set of correlations, the attack graph is a first attack graph, the set of attack subgraphs is a first set of attack subgraphs, the signal is a first signal, the at least one remedial action is at least one first remedial action, and the processor further configured to:
identify a second bucket associated with a subsequent cybersecurity alert, the second bucket different than the first bucket, the second bucket uniquely associated with a second attribute different than the first attribute, the subsequent cybersecurity alert associated with the second attribute, the second bucket associated with a second set of cybersecurity alerts that includes the second subsequent cybersecurity alert;
determine, based on the second set of cybersecurity alerts, a second set of correlations between cybersecurity alerts included in the second set of cybersecurity alerts to update a second attack graph associated with the second set of cybersecurity alerts;
identify a second set of attack subgraphs from the second attack graph; and
in response to a maliciousness score for an attack subgraph from the second set of attack subgraphs being outside the predetermined maliciousness score range, send a second signal to cause at least one second remedial action.
13. The apparatus of claim 11 , wherein the set of attack subgraphs is a first set of attack subgraphs, the signal is a first signal, the at least one remedial action is at least one first remedial action, and the processor further configured to:
update the set of cybersecurity alerts to generate an updated set of cybersecurity alerts that include the set of cybersecurity alerts and a subsequent cybersecurity alert;
update the set of correlations based on correlations between cybersecurity alerts included in the updated set of cybersecurity alerts to generate an updated attack graph associated with the updated set of cybersecurity alerts;
identify a second set of attack subgraphs from the updated attack graph; and
in response to a maliciousness score for an attack subgraph from the second set of attack subgraphs being outside the predetermined maliciousness score range, send a second signal to cause at least one second remedial action.
14. The apparatus of claim 11 , wherein:
the processor is configured to send the signal to cause the at least one remedial action at a compute device associated with a cybersecurity analyst by causing a cybersecurity alert to be provided to the cybersecurity analyst indicating that the maliciousness score is outside the predetermined maliciousness score range.
15. The apparatus of claim 11 , wherein:
the stream of cybersecurity alerts are associated with a computer environment, and
the processor is configured to send the signal to cause the at least one remedial action by causing a mode of operation of the computer environment to change.
16. A non-transitory processor-readable medium storing code representing instructions to be executed by one or more processors, the instructions comprising code to cause the one or more processors to:
associate, via a processor, each cybersecurity alert from a stream of cybersecurity alerts, based on a set of attributes associated with that cybersecurity alert and as that cybersecurity alert is received, to a bucket from a set of buckets, each bucket from the set of buckets associated with (1) an attribute from the set of attributes different than remaining buckets from the set of buckets and (2) a set cybersecurity alerts from the stream of cybersecurity alerts having the attribute;
for each bucket from the set of buckets,
determine, via the processor and based on the set of cybersecurity alerts for that bucket, a set of correlations between cybersecurity alerts included in the set of cybersecurity alerts for that bucket to generate an attack graph associated with that bucket, and
partition, via the processor and based on a linear greedy approach, the attack graph associated with that bucket to determine a set of attack subgraphs within the attack graph associated with that bucket; and
in response to a maliciousness score for an attack subgraph from the set of attack subgraphs being outside a predetermined maliciousness score range, send, via the processor, a signal to cause at least one remedial action.
17. The non-transitory processor-readable medium of claim 16 , wherein the set of attributes includes a set of usernames and a set of internet protocol (IP) addresses.
18. The non-transitory processor-readable medium of claim 16 , wherein the set of buckets includes a first subset of buckets associated with a first hash table and a second subset of buckets associated with a second hash table different than the first hash table.
19. The non-transitory processor-readable medium of claim 16 , wherein, for each bucket from the set of buckets, the code to determine the set of correlations amongst the set of cybersecurity alerts for that bucket includes code to determine, for each pair of cybersecurity alerts from the set of cybersecurity alerts, whether or not a graph edge is associated with that pair of cybersecurity alerts.
20. The non-transitory processor-readable medium of claim 16 , wherein, for each bucket from the set of buckets, the attack graph associated with that bucket is not generated based on cybersecurity alerts included in the set of cybersecurity alerts for that bucket that are not correlated.