Autonomous Cyber-Security Investigation and Response using Graphs
A system for autonomous cyber-security investigation includes an input interface and one or more processors. The input interface receives security-related inputs detected in a computer system. The processors construct, based on the security-related inputs, a graph including nodes and edges. The nodes include (i) appearance-nodes representing occurrences in the computer system having respective times-of-occurrence and (ii) artifact-nodes representing time-static features found in the security-related inputs. The edges represent relationships between the nodes. The processors select a trigger node that serves as an initial trigger for a given cyber-security investigation, perform an iterative process that generates a sub-graph of the graph that is specific to the given cyber-security investigation, by iteratively (i) enriching the graph with additional information and (ii) expanding the sub-graph with additional nodes from the graph in response to the additional information, and decide on a result of the given cyber-security investigation based on the sub-graph.
1 . A system for autonomous cyber-security investigation, the system comprising:
an input interface, configured to receive security-related inputs detected in a computer system; and
one or more processors, configured to:
construct, based on the security-related inputs, a graph comprising nodes and edges, the nodes comprising (i) one or more appearance-nodes representing occurrences in the computer system having respective times-of-occurrence and (ii) one or more artifact-nodes representing time-static features found in the security-related inputs, and the edges representing relationships between the nodes;
select in the graph a trigger node that serves as an initial trigger for a given cyber-security investigation;
perform an iterative process that generates a sub-graph of the graph that is specific to the given cyber-security investigation, by iteratively (i) enriching the graph with additional information and (ii) expanding the sub-graph with one or more additional nodes from the graph in response to the additional information; and
decide on a result of the given cyber-security investigation based on the sub-graph.
2 . The system according to claim 1 , wherein the one or more processors are further configured to initiate a responsive action based on the result of the given cyber-security investigation.
3 . The system according to claim 1 , wherein the one or more processors are configured to enrich the graph by fetching at least part of the additional information from the computer system.
4 . The system according to claim 1 , wherein the one or more processors are configured to iteratively expand the sub-graph, starting from the trigger node, until failing to find additional nodes whose distance from the trigger node is below one or more defined cut-off distances.
5 . The system according to claim 4 , wherein the one or more processors are configured to:
assign respective significance scores to the nodes; and
calculate the distance between a candidate node and the trigger node responsively to the relevance scores of one or more nodes that lie along a shortest path through the graph between the candidate node and the trigger node.
6 . The system according to claim 1 , wherein the one or more processors are configured to enrich the graph in accordance with a predefined bank of enrichment rules.
7 . The system according to claim 1 , wherein the one or more processors are configured to decide on the result of the given cyber-security investigation by running multiple attack detection modules, each attack detection module associated with a respective type of malicious attack.
8 . The system according to claim 7 , wherein a given attack detection module is configured to calculate for the sub-graph a maliciousness score indicative of a likelihood that the sub-graph represents a malicious attack of the respective type.
9 . A method for autonomous cyber-security investigation, the method comprising:
receiving security-related inputs detected in a computer system;
constructing, based on the security-related inputs, a graph comprising nodes and edges, the nodes comprising (i) one or more appearance-nodes representing occurrences in the computer system having respective times-of-occurrence and (ii) one or more artifact-nodes representing time-static features found in the security-related inputs, and the edges representing relationships between the nodes;
selecting in the graph a trigger node that serves as an initial trigger for a given cyber-security investigation;
performing an iterative process that generates a sub-graph of the graph that is specific to the given cyber-security investigation, by iteratively (i) enriching the graph with additional information and (ii) expanding the sub-graph with one or more additional nodes from the graph in response to the additional information; and
deciding on a result of the given cyber-security investigation based on the sub-graph.
10 . The method according to claim 9 , further comprising initiating a responsive action based on the result of the given cyber-security investigation.
11 . The method according to claim 9 , wherein enriching the graph comprises fetching at least part of the additional information from the computer system.
12 . The method according to claim 9 , wherein performing the iterative process comprises iteratively expanding the sub-graph, starting from the trigger node, until failing to find additional nodes whose distance from the trigger node is below one or more defined cut-off distances.
13 . The method according to claim 12 , further comprising:
assigning respective significance scores to the nodes; and
calculating the distance between a candidate node and the trigger node responsively to the relevance scores of one or more nodes that lie along a shortest path through the graph between the candidate node and the trigger node.
14 . The method according to claim 9 , wherein enriching the graph comprises applying a predefined bank of enrichment rules.
15 . The method according to claim 9 , wherein deciding on the result of the given cyber-security investigation comprises running multiple attack detection modules, each attack detection module associated with a respective type of malicious attack.
16 . The method according to claim 15 , wherein running the attack detection modules comprises, in a given attack detection module, calculating for the sub-graph a maliciousness score indicative of a likelihood that the sub-graph represents a malicious attack of the respective type.
17 . A computer software product, the product comprising a tangible non-transitory computer-readable medium in which program instructions are stored, which instructions, when read by one or more processors, cause the one or more processors to:
receive security-related inputs detected in a computer system;
construct, based on the security-related inputs, a graph comprising nodes and edges, the nodes comprising (i) one or more appearance-nodes representing occurrences in the computer system having respective times-of-occurrence and (ii) one or more artifact-nodes representing time-static features found in the security-related inputs, and the edges representing relationships between the nodes;
select in the graph a trigger node that serves as an initial trigger for a given cyber-security investigation;
perform an iterative process that generates a sub-graph of the graph that is specific to the given cyber-security investigation, by iteratively (i) enriching the graph with additional information and (ii) expanding the sub-graph with one or more additional nodes from the graph in response to the additional information; and
decide on a result of the given cyber-security investigation based on the sub-graph.
18 . The product according to claim 17 , wherein the instructions cause the one or more processors to enrich the graph by fetching at least part of the additional information from the computer system.
19 . The system according to claim 17 , wherein the instructions cause the one or more processors to iteratively expand the sub-graph, starting from the trigger node, until failing to find additional nodes whose distance from the trigger node is below one or more defined cut-off distances.
20 . The system according to claim 17 , wherein the instructions cause the one or more processors to decide on the result of the given cyber-security investigation by running multiple attack detection modules, each attack detection module associated with a respective type of malicious attack.