Cybersecurity investigation tools utilizing information graphs
Example apparatus disclosed herein iteratively link data from one or more cybersecurity tools based on a graph schema to generate an information graph. Disclosed example apparatus also cause presentation of a first pattern detected in the information graph. Disclosed example apparatus further update the information graph based on data from at least one of the cybersecurity tools, the at least one of the cybersecurity tools selected based on a second pattern, the second pattern associated with a known cyberattack technique.
1 . An apparatus comprising:
interface circuitry;
computer readable instructions stored on a non-transitory computer readable medium; and
at least one processor circuit to be programmed by the computer readable instructions to:
iteratively link data from one or more cybersecurity tools based on a graph schema to generate an information graph;
cause presentation of a first pattern comprising of a first path detected in the information graph;
expand the first path detected in the information graph based on data from at least one of the cybersecurity tools, the at least one of the cybersecurity tools selected based on a second pattern comprising of a second path in the graph schema that corresponds to the first path detected in the information graph, the second pattern associated with a previously known cyberattack technique stored in a knowledge base; and
cause presentation of the expanded first path in the information graph.
2 . The apparatus of claim 1 , wherein the second pattern is a reference pattern associated with the known cyberattack technique, and the first pattern corresponds to at least a portion of the reference pattern.
3 . The apparatus of claim 2 , wherein one or more of the at least one processor circuit is to:
annotate the information graph based on user input; and
search the annotated information graph for an additional reference pattern, the additional reference pattern associated with an additional known cyberattack technique.
4 . The apparatus of claim 1 , wherein one or more of the at least one processor circuit is to select the at least one of the cybersecurity tools based on user input obtained after the presentation of the first pattern.
5 . The apparatus of claim 1 , wherein one or more of the at least one processor circuit is to output an inference corresponding to the first pattern, the inference associated with a confidence score.
6 . The apparatus of claim 5 , wherein one or more of the at least one processor circuit is to adjust the confidence score based on user input.
7 . The apparatus of claim 1 , wherein the graph schema is to specify relationships among the one or more cybersecurity tools, respective ones of the cybersecurity tools having respective input-output data relationships, the respective ones of the cybersecurity tools to specify respective procedures to obtain respective data that satisfies the respective input-output data relationships, and one or more of the at least one processor circuit is to:
detect an event associated with a computing device; and
initiate generation of the information graph based on a selected one of the cybersecurity tools that has an input-output relationship associated with the event.
8 . At least one non-transitory computer readable medium comprising computer readable instructions to cause at least one processor circuit to at least:
iteratively generate an information graph based on a graph schema and data from one or more of a plurality of cybersecurity tools;
after detection of a first pattern comprising of a first path in the information graph, select a cybersecurity tool from the plurality of cybersecurity tools based on a second pattern comprising of a second path in the graph schema that corresponds to the first path detected in the information graph, the second pattern associated with a previously known cyberattack technique stored in a knowledge base;
expand the first path detected in the information graph based on data from the selected cybersecurity tool; and
cause presentation of the expanded first path in the information graph.
9 . The at least one non-transitory computer readable medium of claim 8 , wherein the second pattern is a reference pattern associated with the known cyberattack technique, and the first pattern corresponds to at least a portion of the reference pattern.
10 . The at least one non-transitory computer readable medium of claim 9 , wherein the instructions are to cause one or more of the at least one processor circuit to:
annotate the information graph based on user input; and
search the annotated information graph for an additional reference pattern, the additional reference pattern associated respectively with an additional known cyberattack technique.
11 . The at least one non-transitory computer readable medium of claim 8 , wherein the instructions are to cause one or more of the at least one processor circuit to select the cybersecurity tool based on user input obtained after presentation of the first pattern.
12 . The at least one non-transitory computer readable medium of claim 8 , wherein the instructions are to cause one or more of the at least one processor circuit to output an inference corresponding to the first pattern, the inference associated with a confidence score.
13 . The at least one non-transitory computer readable medium of claim 12 , wherein the instructions are to cause one or more of the at least one processor circuit to adjust the confidence score based on user input.
14 . The at least one non-transitory computer readable medium of claim 8 , wherein the selected cybersecurity tool is a first cybersecurity tool, the graph schema is to specify relationships among the plurality of cybersecurity tools, respective ones of the cybersecurity tools having respective input-output data relationships, the respective ones of the cybersecurity tools to specify respective procedures to obtain respective data that satisfies the respective input-output data relationships, and one or more of the at least one processor circuit is to:
detect an event associated with a computing device;
select a second cybersecurity tool of the plurality of cybersecurity tools that has an input-output relationship associated with the event; and
initiate generation of the information graph based on the second cybersecurity tool.
15 . An apparatus comprising:
interface circuitry;
computer readable instructions stored on a non-transitory computer readable medium; and
at least one processor circuit to be programmed by the computer readable instructions to:
iteratively link data from one or more cybersecurity tools based on a graph schema to generate an information graph;
detect a first pattern comprising of a first path in the information graph;
detect a first one of the cybersecurity tools based on a second pattern comprising of a second path in the graph schema that corresponds to the first path detected in the information graph, the second pattern associated with a previously known cyberattack technique stored in a knowledge base;
expand the first path detected in the information graph based on data from the selected first one of the cybersecurity tools; and
cause presentation of the expanded first path in the information graph.
16 . The apparatus of claim 15 , wherein the second pattern is a reference pattern associated with the known cyberattack technique, and the first pattern corresponds to at least a portion of the reference pattern.
17 . The apparatus of claim 16 , wherein one or more of the at least one processor circuit is to:
annotate the information graph based on user input; and
search the annotated information graph for an additional reference pattern, the additional reference pattern associated with an additional known cyberattack technique.
18 . The apparatus of claim 15 , wherein one or more of the at least one processor circuit is to select the first one of the cybersecurity tools based on user input obtained after presentation of the first pattern.
19 . The apparatus of claim 15 , wherein one or more of the at least one processor circuit is to output an inference corresponding to the first pattern, the inference associated with a confidence score.
20 . The apparatus of claim 19 , wherein one or more of the at least one processor circuit is to adjust the confidence score based on user input.