Computer network threat assessment

#This disclosure relates in general to computer network assessment.

#Private networks may be at risk to directed attacks that attempt to overwhelm services, discover passwords and other valuable information, and otherwise misuse private network resources. Such attacks may often be targeted at specific networks and take the form of attacks that attempt to install malicious software (e.g., software that attempts to corrupt systems, steal information or create denial of service issues), or that otherwise attempt to cause crashes or network damage. Attacks often follow a common pattern, such as in a manner tied to source identity, target identity or attack type.

#In a first aspect, a non-transitory computer-readable storage medium is provided for storing instructions that, when executed by a processor, facilitate performance of operations for aggregating computer network threat information from multiple networks to enhance computer network security. The operations include, receiving from client networks respective threat data and storing the respective threat data in a security event database. The operations include, maintaining affiliations for groups, where the affiliation for a group associates the group with a subset of the client networks. The operations include, processing content in the security event database to detect correlation between a first network threat and a first one of the groups. The operations include, identifying at least one indicator associated with the first network threat. The operations include, dependent on the affiliation for the first one of the groups, identifying at least one of the client networks and generating at least one message, which conveys an alert to the at least one of the client networks, comprising the at least one indicator. The operations include, responsive to the at least one message, receiving, from the at least one of the client networks, a report of detected correlation between the at least one indicator and security event data maintained by the at least one of the client networks. The operations include, updating the security event database responsive to the report of detected correlation between the at least one indicator and the security event data maintained by the at least one client network.

#The description herein makes reference to the accompanying drawings, wherein like reference numerals refer to like parts throughout the several views.

#FIG. 1 is an illustrative diagram related to components of a security event aggregation service; the left-hand side of FIG. 1 shows a number of clients each having a sentinel or automated client portal (ACP), with internal structure of one client (client N 103) shown in expanded detail. The right-hand side of FIG. 1 shows functions associated with a security event aggregator (or hub).

#FIG. 2A is a block diagram that shows example functions associated with a security event aggregator or hub.

#A private computer network that is connected to a wide area network (e.g., the Internet) often faces a persistent assault by network security threats (e.g., cyber-attacks) that continue to evolve. The operator of such a private network can select from an ever increasing number of computer network security products offered by various software vendors to try to mitigate their exposure to network security threats. These products and related software and definitional updates (e.g., virus definition updates) may be provided in a manner to attempt to keep pace with evolving new network security threats.

#Despite the sophistication of these network security products, protocols for sharing relevant threat information are generally limited. For example, network operators may be reluctant to share information that reveals information about their networks and their vulnerabilities. As an example, it is not uncommon for sources of threats (e.g., hackers) to share techniques and follow logical patterns in attempting to discover and exploit weaknesses in specific networks (for example, the network of a specific company). By contrast, client networks such the specific company in this example are reluctant to share information which they feel may publicly expose, compromise, or reveal security vulnerabilities or otherwise draw attention to a particular entity, or encourage additional attacks. For example, an entity in a specific field or industry (e.g., online retailer) might not have the same exposure, or face the same type of attack, as entities in a different field or industry (e.g., defense contractor). As these issues suggest, there exists little in the way of systems or services that provide an ability to dynamically predict attacks based on previous attack patterns in a manner specific to industry, company, platform or geography.

#Systems and methods described herein may address the problem of the persistent need for timely updated information regarding fast evolving network security threats that are endemic in a wide area network (e.g., the Internet). Network threat information is received from many different client networks and aggregated by a central hub. For example, information about a new threat may be correlated with a group of similar client networks that are serviced by the hub. The hub may then query one or more client networks in the potentially affected group of client networks, prompting the client networks to search for information in their own private data that may be relevant (e.g., correlated) to the new network threat and report their findings back to the hub. Information sent to the hub may be sanitized to remove sensitive identifying information about a client network sharing information. Encryption schemes may also be used to further obscure the identity of a client network sharing information about a new network threat, while still providing the information that needs to be aggregated in order to alert client networks that may be potentially affected by the new network threat and in some cases to identify and/or automatically deploy mitigation measures (e.g., a firewall rule) for the new network threat. A quick response to new network threats enabled by information sharing among many client networks may decrease the exposure of the client networks to these new networks threats and enhance network security for the client networks, which may improve average performance and efficiency of the client networks (e.g., by increasing up-time). Further, sanitizing data and other measures to obscure the identity of a client network sharing network threat information may help to solve the problem of network administrator reluctance to sharing network threat information.