Differential dependency tracking for attack forensics
AssigneeNEC Laboratories America, Inc.
InventorsZhichun Li, Zhenyu Wu, Zhiyun Qian, Guofei Jiang, Masoud Akhoondi, Markus Kusano
Life of this patent
Estimating the term…
Abstract
Methods and systems for intrusion attack recovery include monitoring two or more hosts in a network to generate audit logs of system events. One or more dependency graphs (DGraphs) is generated based on the audit logs. A relevancy score for each edge of the DGraphs is determined. Irrelevant events from the DGraphs are pruned to generate a condensed backtracking graph. An origin is located by backtracking from an attack detection point in the condensed backtracking graph.
Claims14
A computer-implemented method for intrusion attack recovery, comprising:
- monitoring two or more hosts in a network to generate audit logs of system events;
- generating one or more dependency graphs (DGraphs) based on the audit logs;
- determining a relevancy score for each of a plurality of edges of the DGraphs;
- pruning irrelevant events from the DGraphs to generate a condensed backtracking graph;
- and
- backtracking from an attack detection point in the condensed backtracking graph to locate an origin.
A system for intrusion attack recovery, comprising:
- a remote host monitor configured to monitoring two or more hosts in a network to generate audit logs of system events and to generate one or more dependency graphs (DGraphs) based on the audit logs;
- a relevance determiner comprising a processor configured to determine a relevancy score for each of a plurality of edges of the DGraphs and to pruning irrelevant events from the DGraphs to generate a condensed backtracking graph;
- and
- a backtracker configured to backtrack from an attack detection point in the condensed backtracking graph to locate an origin.
Dependencies are inferred from the claim text.