Cyberattack signature generation using host level data analytics

A system for generating a cyberattack signature based on host level data analysis, the system comprising:

• a memory configured to store executable code;
• and
• a processor for cooperation with the memory;
• wherein the processor, in response to execution of the executable code, is configured to:
• apply host level data analytics to system performance data with respect to a set of internal system parameters of one or more host computer systems that describe operation of the one or more host computer systems when known to be under a cyberattack and when known not to be under the cyberattack to find a subset of the internal system parameters and their corresponding data values that discriminatively correlate to the cyberattack, wherein the cyberattack comprises a Nessus enumeration scan;
• and
• generate the cyberattack signature based on the subset of internal system parameters and their corresponding data values that are found to discriminatively correlate to the cyberattack;
• wherein the cyberattack signature for the Nessus enumeration scan comprises (1) an increase of at least two members of the group consisting of (i) activity for inbound network packets, (ii) process switching per second, (iii) processor usage, and (iv) processor interrupts over a first defined time period relative to a normal baseline for same, followed by (2) normal activity for the at least two members over a second defined time period, followed by (3) another increase of the at least two members over a third defined time period relative to the normal baseline for same.

A method for generating a cyberattack signature based on host level data analysis, the method comprising:

• collecting normal system performance data from one or more host computer systems when the one or more host computer systems is known to not be under a cyberattack, wherein the normal system performance data comprises a plurality of data values that describe a set of internal system parameters of the one or more host computer systems when known to not be under the cyberattack during operation thereof over time;
• collecting attacked system performance data from one or more host computer systems when the one or more host computer systems is known to be under the cyberattack, wherein the attacked system performance data comprises a plurality of data values that describe the set of internal system parameters of the one or more host computer systems when known to be under the cyberattack during operation thereof over time;
• a processor applying host level data analytics by comparatively analyzing the normal system performance data with respect to the attacked system performance data to identify a subset of the internal system parameters and their corresponding data values that discriminatively correlate to the cyberattack;
• and
• the processor generating the cyberattack signature based on the subset of internal system parameters and their corresponding data values that are found to discriminatively correlate to the cyberattack.

An article of manufacture for generating a cyberattack signature based on host level data analysis, the article of manufacture comprising:

• machine-readable code that is resident on a non-transitory computer-readable storage medium, wherein the code is executable by a processor to cause the processor to:
• collect normal system performance data from one or more host computer systems when the one or more host computer systems is known to not be under a cyberattack, wherein the normal system performance data comprises a plurality of data values that describe a set of internal system parameters of the one or more host computer systems when known to not be under the cyberattack during operation thereof over time;
• collect attacked system performance data from one or more host computer systems when the one or more host computer systems is known to be under the cyberattack, wherein the attacked system performance data comprises a plurality of data values that describe the set of internal system parameters of the one or more host computer systems when known to be under the cyberattack during operation thereof over time;
• apply host level data analytics to comparatively analyze the normal system performance data with respect to the attacked system performance data to identify a subset of the internal system parameters and their corresponding data values that discriminatively correlate to the cyberattack;
• and
• generate the cyberattack signature based on the subset of internal system parameters and their corresponding data values that are found to discriminatively correlate to the cyberattack.