# US 11,115,437 B2 · Cyber-security system and methods thereof for detecting and mitigating advanced persistent threats > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,437 B2 - Document ID: US11115437B2 - Status: Granted - Kind: B2 - Application number: 14/799,954 - Filed: 2015-07-15 - Published: 2016-02-25 - Granted: 2021-09-07 - Earliest claimed: 2014-07-18 - Assignees: Cybereason Inc. - Applicants: Cybereason Inc. - Inventors: Avi Chesla - Web page: https://patentgrep.com/patent/US11115437B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method and system for adaptively securing a protected entity against a potential advanced persistent threat (APT) are provided. The method includes probing a plurality of resources in a network prone to be exploited by an APT attacker; operating at least one security service configured to output signals indicative of APT related activity of each of the plurality of probed resources; generating at least one security event respective of the output signals; determining if the at least one security event satisfies at least one workflow rule; and upon determining that the at least one security event satisfies the at least one workflow rule, generating at least one action with respect to the potential APT attack. ## Claims ### Claim 1 A method for adaptively securing a protected entity against a potential advanced persistent threat (APT), comprising: probing a plurality of resources, including hosts, in a network prone to be exploited by an APT attacker for APT-related activity; operating at least one security service configured to output signals indicative of APT related activity of each of the plurality of probed resources, wherein the at least one security service is an application behavior anomaly (UNABA) security service, and wherein operating the UNABA security service further comprises detecting APT related activity exploiting legitimate users in the network, wherein the APT attacker pretends normal behavior of the users; generating at least one security event based on the output signals; determining if the at least one security event satisfies at least one workflow rule; upon determining that the at least one security event satisfies the at least one workflow rule, generating at least one action with respect to the potential APT attack; maintaining a profile for each host, wherein the profile includes adaptive and real-time baseline parameters for the host's activity over a period of predefined time; computing, using a plurality of security decision engines, signals of anomaly (SoA) based on the probed APT related activity, the baseline parameters and a set of engine rules, wherein a SoA signal is output by the UNABA security service; correlating signals provided by other services with the computed SoA; and outputting the correlated signal. ### Claim 2 (depends on 1) The method of claim 1, wherein the plurality of resources are active resources. ### Claim 3 (depends on 2) The method of claim 2, wherein each of the plurality of active resources are executing for providing at least one respective service. ### Claim 4 (depends on 1) The method of claim 1, wherein the APT related activity includes at least one of: abnormal usage and abnormal operation of each of the plurality of probed resources. ### Claim 5 (depends on 4) The method of claim 4, wherein the APT related activity includes at least one of: scanning, malware propagation, remote desktop communication channels, processes performed in installation channels, brute-force attacks, protocol usage patterns representing fake applications, and drop-zone traffic representing data leaks. ### Claim 6 (depends on 4) The method of claim 4, wherein APT related activity of each of the plurality of probed resources is analyzed by a plurality of security services. ### Claim 7 (depends on 1) The method of claim 1, wherein the at least one workflow rule applies a set of logical operators on the at least one security event to generate the at least one action. ### Claim 8 (depends on 1) The method of claim 1, wherein generating the at least one security event based on the output signals further comprises: determining if the output signals satisfy at least one event rule; and upon determining that the output signals satisfy the at least one event rule, generating the at least one security event. ### Claim 9 (depends on 8) The method of claim 8, wherein the at least one event rule evaluates at least one of: a signal value, a signal duration, and a signal frequency. ### Claim 10 (depends on 1) The method of claim 1, further comprising: programming each of the plurality of security decision engines to evaluate or detect user behavioral anomalies caused due to APT related activity. ### Claim 11 (depends on 1) The method of claim 1, wherein the at least one action includes activating additional security services to perform any one of: a mitigation action, an investigation action, a detection action. ### Claim 12 A non-transitory computer readable medium having stored thereon instructions for causing processing circuitry to execute a process for adaptively securing a protected entity against a potential advanced persistent threat (APT), the process comprising: probing a plurality of resources, including hosts, in a network prone to be exploited by an APT attacker for APT-related activity; operating at least one security service configured to output signals indicative of APT related activity of each of the plurality of probed resources, wherein the at least one security service is an application behavior anomaly (UNABA) security service, and wherein operating the UNABA security service further comprises detecting APT related activity exploiting legitimate users in the network, wherein the APT attacker pretends normal behavior of the users; generating at least one security event based on the output signals; determining if the at least one security event satisfies at least one workflow rule; upon determining that the at least one security event satisfies the at least one workflow rule, generating at least one action with respect to the potential APT attack; maintaining a profile for each host, wherein the profile includes adaptive and real-time baseline parameters for the host's activity over a period of predefined time; computing, using a plurality of security decision engines, signals of anomaly (SoA) based on the probed APT related activity, the baseline parameters and a set of engine rules, wherein a SoA signal is output by the UNABA security service; correlating signals provided by other services with the computed SoA; and outputting the correlated signal. ### Claim 13 A system for adaptively securing a protected entity against a potential advanced persistent threat (APT), comprising: a processor; and a memory, the memory containing instructions that, when executed by the processor, configure the system to: probe a plurality of resources, including hosts, in a network prone to be exploited by an APT attacker for APT-related activity; operate at least one security service configured to output signals indicative of APT related activity of each of the plurality of probed resources, wherein the at least one security service is an application behavior anomaly (UNABA) security service, and wherein operating the UNABA security service further comprises detecting APT related activity exploiting legitimate users in the network, wherein the APT attacker pretends normal behavior of the users; generate at least one security event based on the output signals; determine if the at least one security event satisfies at least one workflow rule; generate at least one action with respect to the potential APT attack, upon determining that the at least one security event satisfies the at least one workflow rule; maintain a profile for each host, wherein the profile includes adaptive and real-time baseline parameters for the host's activity over a period of predefined time; compute, using a plurality of security decision engines, signals of anomaly (SoA) based on the probed APT related activity, the baseline parameters and a set of engine rules, wherein a SoA signal is output by the UNABA security service; correlate signals provided by other services with the computed SoA; and output the correlated signal. ### Claim 14 (depends on 13) The system of claim 13, wherein the plurality of resources are active resources. ### Claim 15 (depends on 14) The system of claim 14, wherein each of the plurality of active resources are executing for providing at least one respective service. ### Claim 16 (depends on 13) The system of claim 13, wherein the APT related activity includes at least one of: abnormal usage and abnormal operation of each of the plurality of probed resources. ### Claim 17 (depends on 16) The system of claim 16, wherein the APT related activity includes at least one of: scanning, malware propagation, remote desktop communication channels, processes performed in installation channels, brute-force attacks, protocol usage patterns representing fake applications, and drop-zone traffic representing data leaks. ### Claim 18 (depends on 16) The system of claim 16, wherein APT related activity of each of the plurality of probed resources is analyzed by a plurality of security services. ### Claim 19 (depends on 13) The system of claim 13, wherein the at least one workflow rule applies a set of logical operators on the at least one security event to generate the at least one action. ### Claim 20 (depends on 13) The system of claim 13, wherein the system is further configured to: determine if the output signals satisfy at least one event rule; and generate the at least one security event, upon determining that the output signals satisfy the at least one event rule. ### Claim 21 (depends on 20) The system of claim 20, wherein the at least one event rule evaluates at least one of: a signal value, a signal duration, and a signal frequency. ### Claim 22 (depends on 13) The system of claim 13, wherein the system is further configured to: program each of the plurality of security decision engines to evaluate or detect user behavioral anomalies caused due to APT related activity. ### Claim 23 (depends on 13) The system of claim 13, wherein the at least one action includes activating additional security services to perform any one of: a mitigation action, an investigation action, a detection action.