US 10,812,497 B2Granted

Systems and methods for detecting and responding to security threats using application execution and connection lineage tracing

AssigneePrismo Systems Inc.

InventorsAnjan Venkatramani, Chihwei Chao

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods for detecting security threats using application execution and connection lineage tracing with embodiments of the invention are disclosed. In one embodiment, detecting suspicious activity in a network includes receiving at a collector server a first activity data including a first set of attributes, combining a first set of context information with the first activity data to generate a first activity record, comparing the first activity record to a set of baseline signatures, incrementing a count of a first matching baseline signature when the first activity record has the same values for all attributes, receiving a second activity data including a third set of attributes, combining a second set of context information with the second activity data to generate a second activity record, and generating an alert when the attributes of the second activity record differ from all baseline signatures.

Claims38

Dependent claims

A process for detecting suspicious activity in a network and in a computer server system, comprising:

receiving at a collector server, from a first connection and application execution sensor, a first piece of activity data from an observed system, the first piece of activity data comprising a first set of attributes, each attribute having a particular value;
combining, using the collector server, a first set of context information with the first piece of activity data to generate a first activity record, wherein the first piece of activity data includes attributes describing an aspect of an application executing on the observed system;
comparing, using the collector server, the first activity record to a set of baseline signatures, where each baseline signature comprises a second set of attributes, each attribute having a particular value and each baseline signature being unique in the combination of values of its attributes, where the second set of attributes includes an application name and a server name;
incrementing, using the collector server, a count of a first matching baseline signature from the set of baseline signatures when the first activity record has the same values for all attributes in the first matching baseline signature;
receiving at a collector server, from a second connection and application execution sensor, a second piece of activity data comprising a third set of attributes, each attribute having a particular value;
combining, using the collector server, a second set of context information with the second piece of activity data to generate a second activity record;
and
generating, using the collector server, an alert when the values of the attributes of the second activity record differ from all baseline signatures in the set of baseline signatures by at least a predetermined threshold number of attributes and reconfiguring a policy on the second connection and application execution sensor that controls traffic in response to the generated alert.

5 more elements

A collector server for detecting suspicious activity in a network and a computer server system, comprising:

a processor;
a network interface;
and
memory comprising a collector application;
wherein the processor is directed by the collector application to:
receive, from a first connection and application execution sensor, a first piece of activity data from an observed system, the first piece of activity data comprising a first set of attributes, each attribute having a particular value, wherein the first piece of activity data includes attributes describing an aspect of an application executing on the observed system;
combine a first set of context information with the first piece of activity data to generate a first activity record;
compare the first activity record to a set of baseline signatures, where each baseline signature comprises a second set of attributes, each attribute having a particular value and each baseline signature being unique in the combination of values of its attributes, where the second set of attributes includes an application name and a server name;
increment a count of a first matching baseline signature from the set of baseline signatures when the first activity record has the same values for all attributes in the first matching baseline signature;
receive at the collector server, from a second connection and application execution sensor, a second piece of activity data comprising a third set of attributes, each attribute having a particular value;
combine a second set of context information with the second piece of activity data to generate a second activity record;
and
generate an alert when the values of the attributes of the second activity record differ from all baseline signatures in the set of baseline signatures by at least a predetermined threshold number of attributes and reconfiguring a policy on the second connection and application execution sensor that controls traffic in response to the generated alert.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/372,304Filed 7 Dec 2016 · us provisional application
Priority: 7 Dec 2015
Published: US 2017/0163666 A18 Jun 2017
Granted: 20 Oct 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 63/0272
For separating internal from external traffic, e.g. firewalls: virtual private networks
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general