Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems
Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems are provided. These systems and methods provide an alert correlator and an alert distributor that enable early signs of an attack to be detected and rapidly disseminated to collaborating systems. The alert correlator utilizes data structures to correlate alert detections and provide a mechanism through which threat information can be revealed to other collaborating systems. The alert distributor uses an efficient technique to group collaborating systems and then pass data between certain members of those groups according to a schedule. In this way data can be routinely distributed without generating excess traffic loads.
1. A method of detecting a threat to a computer system in a plurality of collaborating computer systems, the method comprising:
receiving, at a first computer system, a first bloom filter from a collaborating second computer system, the first bloom filter representing encrypted first data relating to a source of a first intrusion attempt detected by an intrusion detection system of the collaborating second computer system;
detecting, using an intrusion detection system of the first computer system, a second intrusion attempt;
performing a cryptographic function on second data relating to a source of the second intrusion attempt to produce a second bloom filter;
determining whether the second intrusion attempt correlates with the first intrusion attempt by performing a logical AND operation upon the first bloom filter and the second bloom filter; and
indicating that a threat is present if the second intrusion attempt is determined to correlate with the first intrusion attempt.
2. The method of claim 1 , wherein the encrypted first data relates to the source of the first intrusion attempt through a hash function.
3. The method of claim 1 , wherein the cryptographic function is a hash function.
4. The method of claim 1 , wherein the cryptographic function is an encryption function.
5. The method of claim 1 , wherein receiving the first bloom filter from the collaborating second computer system comprises:
grouping the collaborating second computer system and other collaborating systems into groups so that each collaborating system in a group occupies a position in that group;
exchanging bloom filters between collaborating systems in the same position in the different groups; and
rotating the position occupied by each member of at least one of the groups according to a schedule.
6. function comprises: forming a hash of the second data relating to the second intrusion attempt; using the hash as an index to the bloom filter; and setting corresponding bits in the bloom filter based on the index.
7. The method of claim 1 , wherein performing the cryptographic function comprises: forming a hash of the second data relating to the second intrusion attempt; selecting at least one portion of the hash; using the at least one portion of the hash as an index to the bloom filter; and setting corresponding bits in the bloom filter based on the index.
8. A system of detecting a threat to a computer system in a plurality of collaborating computer systems, the system comprising:
at least one hardware processor configured to:
receive, at a first computer system, a first bloom filter from a collaborating second computer system, the first bloom filter representing encrypted first data relating to a source of a first intrusion attempt detected by an intrusion detection system of the collaborating second computer system;
detect, using an intrusion detection system of the first computer system, a second intrusion attempt;
perform a cryptographic function on second data relating to a source of the second intrusion attempt to produce a second bloom filter;
determine determining whether the second intrusion attempt correlates with the first intrusion attempt by performing a logical AND operation upon the first bloom filter and the second bloom filter; and
indicate that a threat is present if the second intrusion attempt is determined to correlate with the first intrusion attempt.
9. The system of claim 8 , wherein the encrypted first data relates to the source of the first intrusion attempt through a hash function.
10. The system of claim 8 , wherein the cryptographic function is a hash function.
11. The system of claim 8 , wherein the cryptographic function is an encryption function.
12. The system of claim 8 , wherein the hardware processor is also configured to:
group the collaborating second computer system and other collaborating systems into groups so that each collaborating system in a group occupies a position in that group;
exchange bloom filters between collaborating systems in the same position in the different groups; and
rotating the position occupied by each member of at least one of the groups according to a schedule.
13. The system of claim 8 , wherein, in order to perform the cryptographic function, the at least one hardware processor is also configured to: form a hash of the second data relating to the second intrusion attempt; use the hash as an index to the bloom filter; and set corresponding bits in the bloom filter based on the index.
14. The system of claim 8 , wherein, in order to perform the cryptographic function, the at least one hardware processor is also configured to: form a hash of the second data relating to the second intrusion attempt; select at least one portion of the hash; use the at least one portion of the hash as an index to the bloom filter; and set corresponding bits in the bloom filter based on the index.
15. A non-transitory computer readable medium containing computer executable instructions that, when executed by a processor, cause the processor to perform a method of detecting a threat to a computer system in a plurality of collaborating computer systems, the method comprising:
receiving, at a first computer system, a first bloom filter from a collaborating second computer system, the first bloom filter representing encrypted first data relating to a source of a first intrusion attempt detected by an intrusion detection system of the collaborating second computer system;
detecting, using an intrusion detection system of the first computer system, a second intrusion attempt;
performing a cryptographic function on second data relating to a source of the second intrusion attempt to produce a second bloom filter;
determining whether the second intrusion attempt correlates with the first intrusion attempt by performing a logical AND operation upon the first bloom filter and the second bloom filter; and
indicating that a threat is present if the second intrusion attempt is determined to correlate with the first intrusion attempt.
16. The non-transitory computer readable medium of claim 15 , wherein the encrypted first data relates to the source of the first intrusion attempt through a hash function.
17. The non-transitory computer readable medium of claim 15 , wherein the cryptographic function is a hash function.
18. The non-transitory computer readable medium of claim 15 , wherein the cryptographic function is an encryption function.
19. The non-transitory computer readable medium of claim 15 , wherein receiving the first bloom filter from the collaborating second computer system comprises:
grouping the collaborating second computer system and other collaborating systems into groups so that each collaborating system in a group occupies a position in that group;
exchanging bloom filters between collaborating systems in the same position in the different groups; and
rotating the position occupied by each member of at least one of the groups according to a schedule.
20. The non-transitory computer readable medium of claim 15 , wherein performing the cryptographic function comprises: forming a hash of the second data relating to the second intrusion attempt; using the hash as an index to the bloom filter; and setting corresponding bits in the bloom filter based on the index.
21. The non-transitory computer readable medium of claim 15 , wherein performing the cryptographic function comprises: forming a hash of the second data relating to the second intrusion attempt; selecting at least one portion of the hash; using the at least one portion of the hash as an index to the bloom filter; and setting corresponding bits in the bloom filter based on the index.