Reconstructing a dataset after detection of a network security threat in a network

A computer-implemented method for reconstructing a dataset after detection of a network security threat in a network, the method comprising:

• determining a maximum flow for returning data associated with the network security threat to a source dataset via each of a plurality of paths through which the data has passed from the source dataset to a destination dataset;
• starting from the destination dataset, determining the data to be transferred to each dataset in the plurality of paths between the destination dataset and the source dataset such that the data can be returned to the source dataset, the data transferred in each path not exceeding the determined maximum flow for the path;
• adding the details of the determined amount of data to be transferred to a forensic report;
• and
• outputting the forensic report;
• wherein when the network comprises a plurality of source datasets:
• before determining the maximum flow:
• generating a dummy dataset and dummy network events flowing between the dummy dataset and each of the source datasets;
• and
• after determining the maximum flow:
• removing the dummy dataset and dummy network events before the step of determining the data to be transferred to each dataset such that the data can be returned to the source datasets.

A computer-implemented method for reconstructing a dataset after detection of a network security threat in a network, the method comprising:

• determining a plurality of paths, wherein each of the paths comprises a plurality of network events responsible for a transfer of data associated with the network security threat, each network event being between neighbouring datasets in the path, and wherein each network event comprises:
• an obtaining network event through which the data associated with the security threat is originally obtained;
• and
• a returning network event which flows in a reverse direction to the obtaining network event and through which the data associated with the security threat is to be returned;
• determining a maximum flow for returning the data associated with the network security threat to a source dataset via each of the plurality of paths through which the data has passed from the source dataset to a destination dataset, wherein determining the maximum flow comprises:
• (a) determining a theoretical capacity for each of the returning network events;
• (b) fora first of the paths:
• determining a maximum flow for all of the returning network events of the first path, the maximum flow being equal to the determined theoretical capacity of the returning network events in the first path that has the lowest value, such that the same maximum flow applies to all of the returning network events of the first path;
• and
• (c) repeating step (b) for each of the paths;
• and wherein if one or more returning network events are associated with multiple paths the maximum flow of these particular returning network events is updated to be the smaller of:
• the determined theoretical capacity of the returning network events associated with multiple paths that has the lowest value;
• or
• a sum of the lowest determined theoretical capacity of the returning network events in each of the paths that the one or more returning network events are associated with;
• starting from the destination dataset, determining the data to be transferred to each dataset in the plurality of paths between the destination dataset and the source dataset such that the data can be returned to the source dataset, the data transferred in each path not exceeding the determined maximum flow for the path, and wherein determining the data to be transferred to each dataset in the plurality of paths between the destination dataset and the source dataset comprises:
• (i) starting from the destination dataset, determining the value of data to transfer through each returning network event between the destination dataset and its neighbouring datasets, the determining based on the value of the data available at the destination network dataset and the maximum flow for the path the returning network event is associated with;
• (ii) starting from each of the destination dataset's neighbouring datasets, determining the value of data to transfer through each returning network event between this dataset and its neighbouring datasets, the determining based on the value of the data that has been determined to be transferred to this dataset and the maximum flow for the path the returning network event is associated with;
• and
• (iii) repeating step (ii) for each of the datasets along each of the paths until it is determined how the data is to be returned to the source dataset;
• adding the details of the determined amount of data to be transferred to a forensic report;
• and
• outputting the forensic report.

A computer-implemented method for reconstructing a dataset after detection of a network security threat in a network, the method comprising:

• determining a plurality of paths, wherein each of the paths comprises a plurality of network events responsible for a transfer of data associated with the network security threat, each network event being between neighbouring datasets in the path, and wherein each network event comprises:
• an obtaining network event through which the data associated with the security threat is originally obtained;
• and
• a returning network event which flows in a reverse direction to the obtaining network event and through which the data associated with the security threat is to be returned;
• determining a maximum flow for returning the data associated with the network security threat to a source dataset via each of the plurality of paths through which the data has passed from the source dataset to a destination dataset, wherein determining the maximum flow comprises:
• (a) determining a theoretical capacity for each of the returning network events;
• (b) fora first of the paths:
• determining a maximum flow for all of the returning network events of the first path, the maximum flow being equal to the determined theoretical capacity of the returning network events in the first path that has the lowest value, such that the same maximum flow applies to all of the returning network events of the first path;
• and
• (c) repeating step (b) for each of the paths;
• and wherein if one or more returning network events are associated with multiple paths the maximum flow of these particular returning network events is updated to be the smaller of:
• the determined theoretical capacity of the returning network events associated with multiple paths that has the lowest value;
• or
• a sum of the lowest determined theoretical capacity of the returning network events in each of the paths that the one or more returning network events are associated with;
• starting from the destination dataset, determining the data to be transferred to each dataset in the plurality of paths between the destination dataset and the source dataset such that the data can be returned to the source dataset, the data transferred in each path not exceeding the determined maximum flow for the path, and wherein determining the data to be transferred to each dataset in the plurality of paths between the destination dataset and the source dataset further comprises:
• at each dataset where there is more than one returning network event:
• summing the value of the data originally sent to the dataset in each of the obtaining network events associated with that dataset;
• determining a percentage contribution of data each obtaining network event made to the summed total;
• and
• determining the amount of data to be transferred via each of the returning network events by multiplying the contribution of its associated obtaining network event by the available value of data at the dataset, and where this exceeds the maximum flow for that returning network event setting the amount of data to be transferred to be equal to the maximum flow;
• adding the details of the determined amount of data to be transferred to a forensic report;
• and
• outputting the forensic report.

A system configured to reconstruct a dataset after detection of a network security threat in a network, the system comprising:

• a dataset reconstructing module configured to:
• determine a maximum flow for returning data associated with the network security threat to a source dataset via each of a plurality of paths through which the data has passed from the source dataset to a destination dataset;
• starting from the destination dataset, determine an amount of the data associated with the network security threat to be transferred to each dataset in the plurality of paths between the destination dataset and the source dataset such that the data associated with the network security threat can be returned to the source dataset, wherein the data associated with the network security threat to be transferred in each path is less than or equal to the determined maximum flow for the path;
• and
• a forensic report generating module configured to:
• generate a forensic report based on the determined amount of the data associated with the network security threat to be transferred to each dataset;
• and
• output the forensic report.

A non-transitory computer-readable storage medium storing instructions thereon which, when executed by a processor, cause the processor to perform a method for reconstructing a dataset after detection of a network security threat in a network, the method comprising:

• determining a maximum flow for returning data associated with the network security threat to a source dataset via each of a plurality of paths through which the data has passed from the source dataset to the destination dataset;
• starting from the destination dataset, determining an amount of the data associated with the network security threat to be transferred to each dataset in the plurality of paths between the first dataset and the one or more source datasets such that the data associated with the network security threat can be returned to the one or more source datasets, wherein the data associated with the network security threat to be transferred in each path is less than or equal to the determined maximum flow for the path;
• generating a forensic report based on the determined amount of the data associated with the network security threat to be transferred to each dataset;
• and
• outputting the forensic report.