Mapping an attack tree and attack prediction in industrial control and IIoT environment using hash data analytics
AssigneeHoneywell International Inc.
InventorsGanesh Patilba Gadhe, Steven Louie Ypma, Doug Swain, Virgil Mehalek
Life of this patent
Estimating the term…
Abstract
A method, apparatus and computer program product for detecting malicious content and predicting cyberattacks are described herein. In the context of a method, the method receives a hash query comprising a file hash based on one or more files. The method queries a cyberattack case studies information database based on the hash query to generate one or more attack correlation information items associated with at least one of the one or more files. The method also generates and outputs a file security analysis based on the attack correlation information items for authorization of the one or more files.
Claims20
A computer-implemented method for malicious content detection and attack prediction in an industrial control system, comprising:
- receiving a hash query associated with a system from a secure media exchange node, wherein the hash query comprises a file hash generated at the secure media exchange node based at least in part on one or more files received at the secure media exchange node;
- generating an attack tree based at least in part on a combination of a first hash for a first file and a second hash for a second file based on a determination that the first hash and the second hash historically were received in a same hash query;
- querying a cyberattack case studies information database based on the hash query to generate one or more attack correlation information items associated with at least one of the one or more files by comparing the hash query with file hashes stored in the cyberattack case studies information database;
- generating a file security analysis regarding the one or more files based on the one or more attack correlation information items, wherein the file security analysis comprises at least one indication of a predicted malicious content item predicted as previously brought into the system based at least in part on the one or more attack correlation information items,
- wherein querying the cyberattack case studies information database further comprises receiving at least one predictive indicator based at least in part on the attack tree, wherein the file security analysis comprises data representing that the file hash indicates the one or more files comprises the first file and the second file;
- and
- outputting the file security analysis to a secure media exchange threat intelligence portal associated with the secure media exchange node for authorization of the one or more files.
An apparatus configured to detect malicious content and predict attacks in an industrial control system, the apparatus comprising at least one processor and at least one non-transitory memory including program code, the at least one non-transitory memory and the program code configured to, with the processor, cause the apparatus to at least:
- receive a hash query from a secure media exchange node, wherein the hash query comprises a file hash generated at the secure media exchange node based at least in part on one or more files received at the secure media exchange node;
- generate an attack tree based at least in part on a combination of a first hash for a first file and a second hash for a second file based on a determination that the first hash and the second hash historically were received in a same hash query;
- query a cyberattack case studies information database based on the hash query to generate one or more attack correlation information items associated with at least one of the one or more files by comparing the hash query with file hashes stored in the cyberattack case studies information database;
- generate a file security analysis regarding the one or more files based on the one or more attack correlation information items, wherein the file security analysis comprises at least one indication of a predicted malicious content item predicted as previously brought into the system based at least in part on the one or more attack correlation information items,
- wherein querying the cyberattack case studies information database further comprises receiving at least one predictive indicator based at least in part on the attack tree, wherein the file security analysis comprises data representing that the file hash indicates the one or more files comprises the first file and the second file;
- and
- output the file security analysis to a secure media exchange threat intelligence portal associated with the secure media exchange node for authorization of the one or more files.
A computer program product comprising at least one non-transitory computer-readable storage medium having computer-readable program code portions stored therein, the computer-readable program code portions comprising an executable portion configured to:
- receive a hash query from a secure media exchange node, wherein the hash query comprises a file hash generated at the secure media exchange node based at least in part on one or more files received at the secure media exchange node;
- generate an attack tree based at least in part on a combination of a first hash for a first file and a second hash for a second file based on a determination that the first hash and the second hash historically were received in a same hash query;
- query a cyberattack case studies information database based on the hash query to generate one or more attack correlation information items associated with at least one of the one or more files by comparing the hash query with file hashes stored in the cyberattack case studies information database;
- generate a file security analysis regarding the one or more files based on the one or more attack correlation information items, wherein the file security analysis comprises at least one indication of a predicted malicious content item predicted as previously brought into the system based at least in part on the one or more attack correlation information items,
- wherein querying the cyberattack case studies information database further comprises receiving at least one predictive indicator based at least in part on the attack tree, wherein the file security analysis comprises data representing that the file hash indicates the one or more files comprises the first file and the second file;
- and
- output the file security analysis to a secure media exchange threat intelligence portal associated with the secure media exchange node for authorization of the one or more files.
Dependencies are inferred from the claim text.