Attack signature generation
AssigneeRapid7, Inc.
InventorsPaul Deardorff, Dustin Myers
Life of this patent
Estimating the term…
Abstract
Methods and systems for detecting malicious activity on a network. The methods described herein involve gathering data regarding a first state of a computing environment, executing an attack tool to simulate malicious activity in the computing environment, and then gathering data regarding a second state of the computing environment. The methods described herein may then involve generating a signature based on changes between the first and second states, and then using the generated signature to detect malicious activity in a target network.
Claims19
A method for detecting malicious activity on a network, the method comprising:
- gathering data regarding a first state of a computing environment;
- executing at least one attack tool in the computing environment to simulate malicious activity;
- gathering data regarding a second state of the computing environment after the at least one attack tool is executed;
- detecting at least one trace of the malicious activity from the data regarding the second state of the computing environment by comparing the data regarding the second state of the environment to the data regarding the first state of the computing environment;
- and
- autonomously generating at least one signature for detecting future malicious activity, wherein the at least one generated signature is based on the at least one detected trace.
A system for detecting malicious activity on a network, the system comprising:
- at least one attack tool configured to simulate malicious activity;
- and
- a virtual security appliance configured to execute instructions stored on memory to:
- gather data regarding a first state of a computing environment before the attack tool simulates the malicious activity,
- gather data regarding a second state of the computing environment after the attack tool simulates the malicious activity;
- detect at least one trace of the malicious activity from the data regarding the second state of the computing environment by comparing the data regarding the second state of the environment to the data regarding the first state of the computing environment, and
- autonomously generate at least one signature for detecting future malicious activity, wherein the at least one generated signature is based on the at least one detected trace.
The system 10 wherein the attack tool is defined by at least one attack parameter, and the virtual security appliance is further configured to autonomously adjust the at least one attack parameter to generate a variance in the at least one trace of malicious activity and in the at least one generated signature.
A non-transitory computer readable medium containing computer-executable instructions for performing a method for detecting malicious activity on a network, the computer readable medium comprising:
- computer-executable instructions for gathering data regarding a first state of a computing environment;
- computer-executable instructions for executing at least one attack tool in the computing environment to simulate malicious activity;
- computer-executable instructions for gathering data regarding a second state of the computing environment after the at least one attack tool is executed;
- computer-executable instructions for detecting at least one trace of the malicious activity from the data regarding the second state of the computing environment by comparing the data regarding the second state of the environment to the data regarding the first state of the computing environment;
- and
- computer-executable instructions for autonomously generating at least one signature for detecting future malicious activity, wherein the at least one generated signature is based on the at least one detected trace.
Dependencies are inferred from the claim text.