Organization-level ransomware incrimination
Some embodiments help protect an organization against ransomware attacks by combining incrimination logics. An organizational-level incrimination logic helps detect alert spikes across many machines, which collectively indicate an attack. Graph-based incrimination logics help detect infestations of even a few machines, and local incrimination logics focus on protecting respective individual machines. Graph-based incrimination logics may compare monitored system graphs to known ransomware attack graphs. Graphs may have devices as nodes and device network connectivity, repeated files, repeated processes or actions, or other connections as edges. Statistical analyses and machine learning models may be employed as incrimination logics. Search logics may find additional incrimination candidates that would otherwise evade detection, based on files, processes, IP addresses, devices, accounts, or other computational entities previously incriminated. Incrimination engine results are forwarded to endpoint protection systems, intrusion protection systems, authentication controls, or other intervention mechanisms to enhance monitored system security.
1. A computing system which is configured to help protect an organization against a ransomware attack by an organizational ransomware that targets multiple machines of the organization, the computing system comprising:
a digital memory;
an organization-level incrimination logic configured to detect a spike in cybersecurity alerts which occur collectively on at least a specified number of machines of the organization or on at least a specified percentage of machines of the organization, or both;
at least one sub-organization-level incrimination logic configured to detect a cybersecurity anomaly on at least one machine of the organization without regard to the organization-level incrimination logic specified number of machines of the organization and without regard to the organization-level incrimination logic specified percentage of machines of the organization;
an incrimination logics interface in operable digital communication with the incrimination logics;
a processor in operable communication with the digital memory, the processor configured to execute organizational protection against the organizational ransomware, the execution of organizational protection comprising execution of a two-level approach which combines consideration of alerts from a group of machines by using the organization-level incrimination logic with consideration of alerts from fewer machines or from only a single machine by using the at least one sub-organization-level incrimination logic, in order to detect organizational ransomware, the organizational ransomware being a particular kind of malware which is designed to spread among multiple machines without detection and then present a ransom demand, the organizational protection including: collecting at least one incrimination candidate, the incrimination candidate comprising a set of one or more attack indication computational entities, the collecting based on at least one cybersecurity alert specifying at least one computational entity of at least one machine of the organization, the at least one incrimination candidate including the at least one computational entity, submitting the at least one collected incrimination candidate to the incrimination logics interface and in response receiving an incrimination boost attempt result, determining that the incrimination boost attempt result indicates a boost in an incrimination confidence past a specified threshold, marking each computational entity specified in the at least one cybersecurity alert as an incriminated computational entity, the marking being in response to the boost attempt result indicating that the incrimination confidence passed the specified threshold, and notifying an intervention mechanism of the incriminated computational entity.
2. The computing system of claim 1 , wherein the at least one sub-organization-level incrimination logic comprises a graph-based incrimination logic, the graph-based incrimination logic comprising computing hardware configured by software to detect a cybersecurity anomaly based on a digital graph representation of the following: at least two machines of the organization, at least one connection between machines of the organization, and at least one machine attribute or at least one connection attribute or both.
3. The computing system of claim 2 , wherein the at least one sub-organization-level incrimination logic further comprises a local incrimination logic, the local incrimination logic comprising computing hardware configured by software to detect a cybersecurity anomaly based on a digital representation of data or computational activity or both on a particular machine of the organization.
4. The computing system of claim 1 , wherein the processor is further configured to search for an additional incrimination candidate based on at least one incriminated computational entity.
5. The computing system of claim 1 , further characterized in at least one of the following ways:
the organization-level incrimination logic comprises computing hardware configured by a machine learning software model trained using alert spike data derived from multiple ransomware organizational-level attacks;
the organization-level incrimination logic comprises computing hardware configured by a machine learning software model trained by supervised learning using alert spike data derived from at least one ransomware organizational-level attack;
the sub-organization-level incrimination logic comprises a graph-based incrimination logic, which comprises computing hardware configured by a graph convolutional neural network machine learning software model trained using a graph having nodes which represent machines of the organization, edges which represent connections between machines of the organization, and at least one machine attribute or at least one connection attribute or both; or
the sub-organization-level incrimination logic comprises a graph-based incrimination logic, which comprises computing hardware configured by a graph machine learning software model trained by supervised learning using graphs having nodes which represent machines of the organization, and edges which represent connections between machines of the organization.
6. A method for protecting an organization against a ransomware attack by an organizational ransomware, the organizational ransomware being a particular kind of malware which is designed to spread among multiple machines without detection and then present a ransom demand, the method executed by a computing system, the method comprising:
collecting at least one incrimination candidate based on at least one cybersecurity alert specifying at least one computational entity, the incrimination candidate comprising a set of one or more attack indication computational entities;
submitting at least one collected incrimination candidate to an organization-level incrimination logic via an organization-level incrimination logic interface and in response receiving an organization-level incrimination boost attempt result, the organization-level incrimination logic configured to detect a spike in cybersecurity alerts which occur collectively on at least a specified number of machines of the organization or on at least a specified percentage of machines of the organization, or both;
submitting at least one collected incrimination candidate to at least one sub-organization-level incrimination logic via at least one sub-organization-level incrimination interface and in response receiving at least one sub-organization-level incrimination boost attempt result, the sub-organization-level incrimination logic configured to detect a cybersecurity anomaly on at least one machine of the organization without regard to the organization-level incrimination logic specified number of machines of the organization and without regard to the organization-level incrimination logic specified percentage of machines of the organization;
determining the incrimination boost attempt results collectively indicate a boost in an incrimination confidence past the specified threshold, and marking each computational entity specified in the at least one cybersecurity alert as an incriminated computational entity which is compromised by the organizational ransomware, the marking being in response to the boost attempt results collectively indicating that the incrimination confidence passed the specified threshold; and
notifying an intervention mechanism of the at least one incriminated computational entity;
wherein the method comprises execution of a two-level approach which combines consideration of alerts from a group of machines by using the organization-level incrimination logic with consideration of alerts from fewer machines or from only a single machine by using the at least one sub-organization-level incrimination logic, in order to detect organizational ransomware.
7. The method of claim 6 , further comprising:
receiving the at least one collected incrimination candidate from the organization-level incrimination logic interface;
executing an organization-level incrimination logic which includes performing a statistical analysis of alerts from a substantial amount of machines of the organization, the substantial amount including at least fifteen percent of the machines of the organization or at least ten machines of the organization, or both;
determining the organization-level incrimination boost attempt result based on at least whether the executing identifies an anomaly; and
sending the organization-level incrimination boost attempt result to the organization-level incrimination logic interface.
8. The method of claim 6 , further comprising:
receiving the at least one collected incrimination candidate from the organization-level incrimination logic interface;
executing an organization-level incrimination logic which includes a machine learning model trained using alert data derived from multiple ransomware organizational-level attacks;
determining the organization-level incrimination boost attempt result based on at least an output of the machine learning model; and
sending the organization-level incrimination boost attempt result to the organization-level incrimination logic interface.
9. The method of claim 6 , further comprising:
receiving the at least one collected incrimination candidate from the sub-organization-level incrimination logic interface;
executing a sub-organization-level incrimination logic which includes a machine learning model trained using graph data derived from multiple ransomware organizational-level attacks, the graph data including a graph having nodes which represent machines of the organization, and edges which represent connections between machines of the organization;
determining the sub-organization-level incrimination boost attempt result based on at least an output of the machine learning model; and
sending the sub-organization-level incrimination boost attempt result to the sub-organization-level incrimination logic interface.
10. The method of claim 6 , further comprising searching for an additional incrimination candidate based on at least one incriminated computational entity, and wherein the at least one incriminated computational entity includes or identifies at least one of the following: a computational process in a kernel or an application program, a file, an IP address, a device, or a user account.
11. The method of claim 6 , further comprising executing a sub-organization-level incrimination logic which includes performing at least one of the following graph classification algorithms:
a graph neural network algorithm;
a graph statistical anomaly detection algorithm; or
a bag of words algorithm based on graph node features.
12. The method of claim 6 , further comprising executing a sub-organization-level incrimination logic which includes performing at least one of the following local incrimination logic sequences:
collecting an incriminated file from the at least one cybersecurity alert for a particular machine, and searching other machines of the organization for a copy of the incriminated file;
checking a precision of the at least one cybersecurity alert for a particular machine, and searching the particular machine for a remoting connection; or
discerning an aggregated process tree alerts score of the at least one cybersecurity alert for a particular machine, and searching the particular machine for a remoting connection.
13. The method of claim 6 , wherein the method comprises boosting the incrimination confidence based on at least the following incrimination confidence boost condition: a graph-based sub-organization-level incrimination logic determines that a graph representing the incrimination candidate is similar to graphs of ransomware incidents.
14. The method of claim 6 , wherein the method comprises boosting the incrimination confidence based on at least the following incrimination confidence boost condition: a local sub-organization-level incrimination logic determines that a particular machine of the organization is under ransomware attack, and a computational entity of the incrimination candidate is also found on at least a specified number of other machines of the organization within a specified time period.
15. The method of claim 6 , wherein the method comprises boosting the incrimination confidence based on at least the following incrimination confidence boost condition: at least a specified number of different sub-organization-level incrimination logics and at least a specified number of different machines of the organization are identified in cybersecurity alerts within a specified time period.
16. A computer-readable storage device configured with data and instructions which upon execution by a processor cause a computing system to perform a method for protecting an organization against a ransomware attack by an organizational ransomware, the organizational ransomware being a particular kind of malware which is designed to spread among multiple machines without detection and then present a ransom demand, the method comprising:
submitting at least one incrimination candidate to an organization-level incrimination logic via an organization-level incrimination logic interface and in response receiving an organization-level incrimination boost attempt result, the organization-level incrimination logic configured to detect a spike in cybersecurity alerts which occur collectively on at least a specified number of machines of the organization or on at least a specified percentage of machines of the organization, or both, the incrimination candidate comprising a set of one or more attack indication computational entities;
submitting at least one incrimination candidate to at least one sub-organization-level incrimination logic via at least one sub-organization-level incrimination interface and in response receiving at least one sub-organization-level incrimination boost attempt result, the sub-organization-level incrimination logic configured to detect a cybersecurity anomaly on at least one machine of the organization without regard to the organization-level incrimination logic specified number of machines of the organization and without regard to the organization-level incrimination logic specified percentage of machines of the organization;
ascertaining that the incrimination boost attempt results collectively indicate a boost in an incrimination confidence past a specified threshold; and
in response to the ascertaining, notifying an intervention mechanism that a computational entity of the incrimination candidate is an incriminated computational entity which is compromised by the organizational ransomware;
wherein the method comprises execution of a two-level approach which combines consideration of alerts from a group of machines by using the organization-level incrimination logic with consideration of alerts from fewer machines or from only a single machine by using the at least one sub-organization-level incrimination logic, in order to detect organizational ransomware.
17. The computer-readable storage device of claim 16 , wherein the method further comprises performing at least one of the following graph classification algorithms:
a graph neural network algorithm; or
a graph statistical anomaly detection algorithm.
18. The computer-readable storage device of claim 16 , wherein the method comprises performing a local incrimination logic sequence which includes:
collecting an incriminated file from the at least one cybersecurity alert for a particular machine, and searching other machines of the organization for a copy of the incriminated file.
19. The computer-readable storage device of claim 16 , wherein the method comprises performing a local incrimination logic sequence which includes: checking a precision of the at least one cybersecurity alert for a particular machine, and searching the particular machine for a remoting connection.
20. The computer-readable storage device of claim 16 , wherein the method comprises performing a local incrimination logic sequence which includes: discerning an aggregated process tree alerts score of the at least one cybersecurity alert for a particular machine, and searching the particular machine for a remoting connection.