US 10,949,534 B2Granted

Method for predicting and characterizing cyber attacks

AssigneeSumo Logic, Inc.

InventorsGregory Martin, Thomas Piscitell, III, David Matslofva, Brian Waskiewicz, Scott Woods

Life of this patent

Estimating the term…

Loading patent…

Abstract

One variation of a method for predicting and characterizing cyber attacks includes: receiving, from a sensor implementing deep packet inspection to detect anomalous behaviors on the network, a first signal specifying a first anomalous behavior of a first asset on the network at a first time; representing the first signal in a first vector representing frequencies of anomalous behaviors—in a set of behavior types—of the first asset within a first time window; calculating a first malicious score representing proximity of the first vector to malicious vectors defining sets of behaviors representative of security threats; calculating a first benign score representing proximity of the first vector to a benign vector representing an innocuous set of behaviors; and in response to the first malicious score exceeding the first benign score and a malicious threshold score, issuing a first alert to investigate the network for a security threat.

Claims18

Dependent claims

A method for detecting cyber attacks comprising:

aggregating a first set of signals into a first data structure, each signal in the first set of signals identifying a behavior of a first asset while connected to a network within a first time window;
calculating a first degree of deviation of the first data structure from a corpus of data structures, each data structure in the corpus of data structures representing a previous set of behaviors of an asset, in a set of assets, while connected to the network;
in response to the first degree of deviation exceeding a deviation threshold score, issuing a first alert to investigate the first asset;
and
in response to the deviation threshold score exceeding the first degree of deviation:
calculating a first malicious score of the first asset proportional to proximity of the first data structure to a first malicious data structure defining a first cluster of behaviors representative of a first network security threat;
calculating a first benign score of the first asset proportional to proximity of the first data structure to a benign data structure representing an innocuous set of behaviors;
and
in response to the first malicious score exceeding the first benign score, generating a second alert to investigate the network for the first network security threat.

6 more elements

A method for detecting cyber attacks comprising:

accessing a first set of signals, each signal in the first set of signals identifying a behavior type, in a predefined set of behavior types, of a first asset while connected to a network within a first time window;
aggregating the first set of signals into a first data structure representing frequencies of behavior types, in the predefined set of behavior types, of the first asset during the first time window;
calculating a first magnitude of deviation of frequencies of each behavior type represented in the first data structure from frequencies of each behavior type represented in data structures in a corpus of historical data structures, each data structure in the corpus of historical data structures representing a set of behavior types of an asset, in a set of assets, during a previous time window while connected to the network;
in response to the first magnitude of deviation exceeding a deviation threshold score, generating a first alert to investigate the first asset;
and
in response to the deviation threshold exceeding the first magnitude of deviation:
calculating a first malicious score of the first asset proportional to proximity of the first data structure to a malicious data structure defining a cluster of behaviors representative of a network security threat;
calculating a first benign score of the first asset proportional to proximity of the first data structure to a benign data structure representing an innocuous set of behaviors;
and
in response to the first malicious score exceeding the first benign score, generating a second alert to investigate the network for the first network security threat.

7 more elements

A method for detecting cyber attacks comprising:

aggregating a first set of signals into a first data structure, each signal in the first set of signals identifying a behavior of the first asset while connected to a network within a first time window;
calculating a first magnitude of deviation of the first data structure from a corpus of historical data structures, each data structure in the corpus of historical data structures representing a set of behaviors of an asset, in a set of assets, while connected to the network prior to the first time;
in response to the deviation threshold exceeding the first magnitude of deviation:
calculating a first malicious score of the first asset based on proximity of the first data structure to a first malicious data structure defining a first cluster of behaviors representative of a first network security threat;
calculating a first benign score of the first asset proportional to proximity of the first data structure to a benign data structure representing an innocuous set of behaviors;
and
in response to the first malicious score exceeding the first benign score, generating a first alert to investigate the network for the first network security threat;
aggregating a second set of signals into a second data structure, each signal in the second set of signals identifying a behavior of a second asset while connected to the network within a second time window;
calculating a second magnitude of deviation of the second data structure from the corpus of historical data structures;
and
in response to the second magnitude of deviation exceeding the deviation threshold, generating a second alert to investigate the second asset;
wherein the second alert identifies the first asset.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/440,946Filed 13 Jun 2019 · continuation
Priority: 20 Jun 2016
Published: US 2019/0311121 A110 Oct 2019
Granted: 16 Mar 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

G06F 21/566
Computer malware detection or handling, e.g. anti-virus arrangements: dynamic detection, i.e. detection performed at run-time, e.g. emulation,…
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
G06F 21/577
Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates…:…

Family

Application62/352,313Us provisional application · filed 20 Jun 2016
Application15/628,520Parent of this continuation · filed 20 Jun 2017
US 2019/0311121 A1Pre-grant publication · published 10 Oct 2019
US 10,372,910 B2Parent of this continuation
US 2018/0004948 A1Published application
US 10,949,534 B2This patent

From the US filing history. Foreign family members aren’t listed.