US 10,855,701 B2 · Methods and devices for automatically detecting attack signatures and generating attack signature identifications

Abstract

Network traffic management apparatuses, systems, methods, and computer-readable media for automatically detecting attack signatures and generating attack signature identifications, involving: collecting a stable dataset during a stable time; determining whether a cyber-attack is detected; when a cyber-attack is detected, periodically generating attack signatures and updating an enforcer with the attack signatures, the attack signatures representing dynamic rules to be enforced; validating the dynamic rules via a long-time validation mechanism, validating involving considering behavior of each dynamic rule after the cyber-attack and during a new cyber-attack and ranking each dynamic rule using the stable dataset, thereby generating persistent rules having a dynamic rule; exporting the persistent rules to a security enforcer; introducing the persistent rules to a persistent rule revocater; determining whether export of an unrevoked persistent rule is requested; and if requested, exporting the unrevoked persistent rule of the persistent rules through a mitigator and collecting statistics.

Claims20

Dependent claims

A method of automatically detecting attack signatures and generating attack signature identifications by way of a processor operable via a set of executable instructions storable in relation to a non-transient memory device, the method comprising:

collecting a stable dataset during a stable time;
determining whether a cyber-attack is detected;
when a cyber-attack is detected, periodically generating a set of attack signatures and updating an enforcer with the set of attack signatures, wherein the set of attack signatures represents a set of dynamic rules to be enforced;
validating the set of dynamic rules to be enforced via a long-time validation mechanism, wherein validating comprises considering behavior of each dynamic rule in the set of dynamic rules after the cyber-attack and during a new cyber-attack and ranking each dynamic rule by using the stable dataset, thereby generating a set of persistent rules comprising at least one dynamic rule of the set of dynamic rules having at least a predetermined rank;
exporting the set of persistent rules to a security enforcer mechanism;
introducing the set of persistent rules to a persistent rule revocation mechanism;
determining whether export of at least one unrevoked persistent rule is requested;
and
if requested, exporting the at least one unrevoked persistent rule of the set of persistent rules to a network intrusion detection system through a mitigator and collecting statistics thereof via the statistics collector.

6 more elements

A method of providing a device for automatically detecting attack signatures and generating attack signature identifications, the method comprising:

providing a non-transient memory device storing a set of executable instructions for configuring a processor to:
collect a stable dataset during a stable time;
determine whether a cyber-attack is detected;
when a cyber-attack is detected, periodically generate a set of attack signatures and updating an enforcer with the set of attack signatures, wherein the set of attack signatures represents a set of dynamic rules to be enforced;
validate the set of dynamic rules to be enforced via a long-time validation mechanism, wherein validation comprises consideration of behavior of each dynamic rule in the set of dynamic rules after the cyber-attack and during a new cyber-attack and rank of each dynamic rule by using the stable dataset, whereby a set of persistent rules, comprising at least one dynamic rule of the set of dynamic rules having at least a predetermined rank, is generated;
export the set of persistent rules to a security enforcer mechanism;
introduce the set of persistent rules to a persistent rule revocation mechanism;
determine whether export of at least one unrevoked persistent rule is requested;
and
if requested, export the at least one unrevoked persistent rule of the set of persistent rules to a network intrusion detection system through a mitigator and collect statistics thereof via the statistics collector.

7 more elements

A non-transitory computer readable medium having stored thereon a set of instructions for automatically detecting attack signatures and generating attack signature identifications comprising executable code, which when executed by a processor, configures the processor to:

collect a stable dataset during a stable time;
determine whether a cyber-attack is detected;
when a cyber-attack is detected, periodically generate a set of attack signatures and updating an enforcer with the set of attack signatures, wherein the set of attack signatures represents a set of dynamic rules to be enforced;
validate the set of dynamic rules to be enforced via a long-time validation mechanism, wherein validation comprises consideration of behavior of each dynamic rule in the set of dynamic rules after the cyber-attack and during a new cyber-attack and rank of each dynamic rule by using the stable dataset, whereby a set of persistent rules, comprising at least one dynamic rule of the set of dynamic rules having at least a predetermined rank, is generated;
export the set of persistent rules to a security enforcer mechanism;
introduce the set of persistent rules to a persistent rule revocation mechanism;
determine whether export of at least one unrevoked persistent rule is requested;
and
if requested, export the at least one unrevoked persistent rule of the set of persistent rules to a network intrusion detection system through a mitigator and collect statistics thereof via the statistics collector.

6 more elements

A network traffic management apparatus comprising memory having stored thereon a set of instructions for automatically detecting attack signatures and generating attack signature identifications comprising executable code, which when executed by a processor, configures the processor to:

collect a stable dataset during a stable time;
determine whether a cyber-attack is detected;
when a cyber-attack is detected, periodically generate a set of attack signatures and updating an enforcer with the set of attack signatures, wherein the set of attack signatures represents a set of dynamic rules to be enforced;
validate the set of dynamic rules to be enforced via a long-time validation mechanism, wherein validation comprises consideration of behavior of each dynamic rule in the set of dynamic rules after the cyber-attack and during a new cyber-attack and rank of each dynamic rule by using the stable dataset, whereby a set of persistent rules, comprising at least one dynamic rule of the set of dynamic rules having at least a predetermined rank, is generated;
export the set of persistent rules to a security enforcer mechanism;
introduce the set of persistent rules to a persistent rule revocation mechanism;
determine whether export of at least one unrevoked persistent rule is requested;
and
if requested, export the at least one unrevoked persistent rule of the set of persistent rules to a network intrusion detection system through a mitigator and collect statistics thereof via the statistics collector.

6 more elements

Dependencies are inferred from the claim text.

Methods and devices for automatically detecting attack signatures and generating attack signature identifications

Life of this patent

Methods and devices for automatically detecting attack signatures and generating attack signature identifications

Life of this patent

Abstract

Claims20