Multiphase threat analysis and correlation engine
Provided are systems, methods, and computer-program products for a targeted threat intelligence engine, implemented in a network device. The network device may receive incident data, which may include information derived starting at detection of an attack on the network until detection of an event. The network device may include analytic engines that run in a predetermined order. An analytic engine can analyze incident data of a certain data type, and can produce a result indicating whether a piece of data is associated with the attack. The network device may produce a report of the attack, which may include correlating the results from the analytic engines. The report may provide information about a sequence of events that occurred in the course of the attack. The network device may use the record of the attack to generate indicators, which may describe the attack, and may facilitate configuring security for a network.
1. A computer-implemented method, comprising:
receiving, at a network security device configured to perform network threat analysis, data produced by an emulated network, the data including a record of processes that executed and terminated in the emulated network during a span of time and a record of Application Programming Interface (API) calls made by the processes during the span of time, wherein a process is program code being executed by one or more processors, wherein the process is capable of generating a child process that executes concurrently with the process, wherein the span of time includes a security incident that lead to an identifiable harm in the emulated network, wherein the data is received after conclusion of the span of time, and wherein, at the conclusion of the span of time, no process in the record of processes is still executing in the emulated network;
executing, at the conclusion of the span of time, a first set of analytic engines on the data, wherein the first set of analytic engines:
search the record of processes for a first process that did not generate any child processes, wherein searching is enabled by the record of processes including all processes that executed and terminated during the span of time;
determine, using the record of API calls, a first set of API calls made by the first process; and
classify the first process as malicious or not malicious based on an identity of at least one API call from the first set of API calls;
executing, after executing the first set of analytic engines, a second set of analytic engines on the data, wherein the second set of analytic engines:
identify, using the record of processes, a second process, wherein the second process generated the first process as a child process of the second process;
determine a second set of API calls made by the second process; and
classify the second process as malicious based on an identity of at least one API call from the second set of API calls and a result of classifying the first process;
executing, after executing the second set of analytic engines, a third set of analytic engines, wherein the third set of analytic engines identify a set of files associated with the second process, the set of files including at least a file used to execute the second process;
generating indicators for the set of files, wherein the indicators can be used to identify the set of files; and
distributing the indicators to one or more production network devices on a network, wherein, when the indicators are received by the one or more production network devices, the one or more production network devices are modified to defend against the identifiable harm.
2. The method of claim 1 , wherein the first process is classified as not malicious based on no API call from the first set of API calls being a cause of the identifiable harm.
3. The method of claim 2 , wherein the second process is classified as malicious based on the identity of the at least one API call from the second set of API calls being a cause of the identifiable harm.
4. The method of claim 1 , wherein the first process is classified as malicious based on the identity of the at least one API call from the first set of API calls indicating that the first process is a cause of the identifiable harm.
5. The method of claim 4 , wherein the second process is classified as malicious based on classification of the first process as malicious.
6. The method of claim 1 , wherein the second process generated an additional child process, and wherein the first set of analytic engines determine, based on one or more API calls made by the additional child process, that the additional child process is unrelated to the identifiable harm.
7. The method of claim 1 , wherein the first set of analytic engines search the record of processes for processes of a certain type, wherein the type is determined from current threat intelligence.
8. The method of claim 1 , wherein the emulated network includes virtual machines configured to emulate production network devices in the network, wherein the emulated network includes programs capable of performing behavior associated with users of the production network devices, wherein programs interact with network traffic to produce the data, and wherein the network traffic is input into the emulated network until the identifiable harm occurs.
9. A network device, comprising:
one or more processors; and
a non-transitory computer-readable medium including instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
receiving, at a network security device configured to perform network threat analysis, data produced by an emulated network, the data including a record of processes that executed and terminated in the emulated network during a span of time and a record of Application Programming Interface (API) calls made by the processes during the span of time, wherein a process is program code being executed by one or more processors, wherein the process is capable of generating a child process that executes concurrently with the process, wherein the span of time includes a security incident that lead to an identifiable harm in the emulated network, wherein the data is received after conclusion of the span of time, and wherein, at the conclusion of the span of time, no process in the record of processes is still executing in the emulated network;
executing, at the conclusion of the span of time, a first set of analytic engines on the data, wherein the first set of analytic engines:
search the record of processes for a first process that did not generate any child processes, wherein searching is enabled by the record of processes including all processes that executed and terminated during the span of time;
determine, using the record of API calls, a first set of API calls made by the first process; and
classify the first process as malicious or not malicious based on an identity of at least one API call from the first set of API calls;
executing, after executing the first set of analytic engines a second set of analytic engines on the data, wherein the second set of analytic engines:
identify, using the record of processes, a second process, wherein the second process generated the first process as a child process of the second process;
determine a second set of API calls made by the second process; and
classify the second process as malicious based on an identity of at least one API call from the second set of API calls and a result of classifying the first process;
executing, after executing the second set of analytic engines, a third set of analytic engines, wherein the third set of analytic engines identify a set of files associated with the second process, the set of files including at least a file used to execute the second process;
generating indicators for the set of files, wherein the indicators can be used to identify the set of files; and
distributing the indicators to one or more production network devices on a network, wherein, when the indicators are received by the one or more production network devices, the one or more production network devices are modified to defend against the identifiable harm.
10. The network device of claim 9 , wherein the first process is classified as not malicious based on no API call from the first set of API calls being a cause of the identifiable harm.
11. The network device of claim 10 , wherein the second process is classified as malicious based on the identity of the at least one API call from the second set of API calls being a cause of the identifiable harm.
12. The network device of claim 9 , wherein the first process is classified as malicious based on the identity of the at least one API call from the first set of API calls indicating that the first process is a cause of the identifiable harm.
13. The network device of claim 12 , wherein the second process is classified as malicious based on classification of the first process as malicious.
14. The network device of claim 9 , wherein the second process generated an additional child process, and wherein the first set of analytic engines determine, based on one or more API calls made by the additional child process, that the additional child process is unrelated to the identifiable harm.
15. The network device of claim 9 , wherein the first set of analytic engines search the record of processes for processes of a certain type, wherein the type is determined from current threat intelligence.
16. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions that, when executed by one or more processors, cause the one or more processors to:
receive data produced by an emulated network, the data including a record of processes that executed and terminated in the emulated network during a span of time and a record of Application Programming Interface (API) calls made by the processes during the span of time, wherein a process is program code being executed by one or more processors, wherein the process is capable of generating a child process that executes concurrently with the process, wherein the span of time includes a security incident that lead to an identifiable harm in the emulated network, wherein the data is received after conclusion of the span of time, and wherein, at the conclusion of the span of time, no process in the record of processes is still executing in the emulated network;
execute, at the conclusion of the span of time, a first set of analytic engines on the data, wherein the first set of analytic engines:
search the record of processes for a first process that did not generate any child processes;
determine, using the record of API calls, a first set of API calls made by the first process; and
classify the first process as malicious or not malicious based on an identity of at least one API call from the first set of API calls;
execute, after executing the first set of analytic engines, a second set of analytic engines on the data, wherein the second set of analytic engines:
identify, using the record of processes, a second process, wherein the second process generated the first process as a child process of the second process;
determine a second set of API calls made by the second process; and
classify the second process as malicious based on an identity of at least one API call from the second set of API calls and a result of classifying the first process;
execute, after executing the second set of analytic engines, a third set of analytic engines, wherein the third set of analytic engines identify a set of files associated with the second process, the set of files including at least a file used to execute the second process;
generate indicators for the set of files, wherein the indicators can be used to identify the set of files; and
distribute the indicators to one or more production network devices on a network, wherein, when the indicators are received by the one or more production network devices, the one or more production network devices are modified to defend against the identifiable harm.
17. The computer-program product of claim 16 , wherein the first process is classified as not malicious based on no API call from the first set of API calls being a cause of the identifiable harm.
18. The computer-program product of claim 17 , wherein the second process is classified as malicious based on the identity of the at least one API call from the second set of API calls being a cause of the identifiable harm.
19. The computer-program product of claim 16 , wherein the first process is classified as malicious based on the identity of the at least one API call from the first set of API calls indicating that the first process is a cause of the identifiable harm.
20. The computer-program product of claim 19 , wherein the second process is classified as malicious based on classification of the first process as malicious.
21. The computer-program product of claim 16 , wherein the second process generated an additional child process, and wherein the first set of analytic engines determine, based on one or more API calls made by the additional child process, that the additional child process is unrelated to the identifiable harm.
22. The computer-program product of claim 16 , wherein the first set of analytic engines search the record of processes for processes of a certain type, wherein the type is determined from current threat intelligence.