Back to results
US 11,770,388 B1Granted
Network infrastructure detection
AssigneeTarget Brands, Inc.
InventorsBreanna Laconic, Alex Foster
Life of this patent
Estimating the term…
Abstract
Network infrastructure can be automatically detected. A network sensor detects a new network message. A source-address of the new network message is extracted. A plurality of addresses are assembled based on the source-address. These are recursed, using each of the unique similar-addresses as current addresses. Metadata is assembled for each of the addresses in the plurality of addresses. For each particular address in the plurality of addresses, a risk-label is assigned out of a plurality of possible risk-labels, by weighing a plurality of factors; and performing a network security action with the risk-label.
Claims18
A method for automatic detection of network infrastructure, the method comprising:
- receiving, by a network sensor, a new network message, wherein the new network message comprises deserialized event data;
- determining whether the new network message is potentially malicious based on the presence of an indicator-of-compromise (IoC), wherein the determining comprises:
- decorating the deserialized event data by adding, to the deserialized event data, at least one of a timestamp, geo-location data, threat intelligence data, and a connection-identifier;
- retrieving a set of IoC rules for detecting one or more IoCs in the decorated event data;
- applying the set of IoC rules to the decorated event data;
- and
- identifying the decorated event data as including one or more IoCs based on application of the set of IoC rules and further decorating the deserialized event data with corresponding IoC information;
- and
- in response to determining that the new network message is potentially malicious, assigning a risk-label to the new network message based on associations with information from other network messages, wherein the identifying comprises:
- extracting, from the decorated event data, a source-address of the new network message;
- assembling a plurality of unique similar-addresses based on the source-address comprising:
- identifying one on or more source-metadata values associated with the source-address;
- searching a group of previous network messages for matching network messages to the new network message, based on the matching network messages having metadata of at least a threshold similarity to at least one of the source-metadata values with the source-address;
- and
- adding the matching network messages to the plurality of unique similar-addresses;
- generating metadata to associate with the source-address for the new message, wherein the metadata is generated by recursively assembling related metadata from each of the plurality of unique-similar addresses;
- assigning, using a plurality of factors, risk-labels to the source-address of the new network message and the plurality of unique similar-addresses based, at least in part, on the metadata associated with the source-address recursively assembled from the related metadata for the plurality of unique-similar addresses, wherein the risk-labels are selected from among a plurality of possible risk-labels, wherein the plurality of possible risk-labels include a safe-label indicating no unsafe behavior was found associated with the address and a tainted-label indicating the address was found to be associated with network architecture identified as malicious;
- and
- performing one or more network security actions based on the risk-labels.
16 more elements
A system comprising:
- one or more hardware processors;
- and
- non-transitory computer memory tangibly containing instructions that, when executed by the processor, cause the processor to perform operations comprising:
- receiving, by a network sensor, a new network message, wherein the new network message comprises deserialized event data;
- determining whether the new network message is potentially malicious based on the presence of an indicator-of-compromise (IoC), wherein the determining comprises:
- decorating the deserialized event data by adding, to the deserialized event data, at least one of a timestamp, geo-location data, threat intelligence data, and a connection-identifier;
- retrieving a set of IoC rules for detecting one or more IoCs in the decorated event data;
- applying the set of IoC rules to the decorated event data;
- and
- identifying the decorated event data as including one or more IoCs based on application of the set of IoC rules and further decorating the deserialized event data with corresponding IoC information;
- and
- in response to determining that the new network message is potentially malicious, assigning a risk-label to the new network message based on associations with information from other network messages, wherein the identifying comprises:
- extracting, from the decorated event data, a source-address of the new network message;
- assembling a plurality of unique similar-addresses based on the source-address comprising:
- identifying one on or more source-metadata values associated with the source-address;
- searching a group of previous network messages for matching network messages to the new network message, based on the matching network messages having metadata of at least a threshold similarity to at least one of the source-metadata values with the source-address;
- and
- adding the matching network messages to the plurality of unique similar-addresses;
- generating metadata to associate with the source-address for the new message, wherein the metadata is generated by recursively assembling related metadata from each of the plurality of unique-similar addresses;
- assigning, using a plurality of factors, risk-labels to the source-address of the new network message and the plurality of unique similar-addresses based, at least in part, on the metadata associated with the source-address recursively assembled from the related metadata for the plurality of unique-similar addresses, wherein the risk-labels are selected from among a plurality of possible risk-labels, wherein the plurality of possible risk-labels include a safe-label indicating no unsafe behavior was found associated with the address and a tainted-label indicating the address was found to be associated with network architecture identified as malicious;
- and
- performing one or more network security actions based on the risk-labels.
19 more elements
Dependencies are inferred from the claim text.