Centralized event detection
AssigneeSophos Limited
InventorsJoseph H. Levy, Andrew J. Thomas, Daniel Salvatore Schiappa, Kenneth D. Ray
Life of this patent
Estimating the term…
Abstract
A threat management facility stores a number of entity models that characterize reportable events from one or more entities. A stream of events from compute instances within an enterprise network can then be analyzed using these entity models to detect behavior that is inconsistent or anomalous for one or more of the entities that are currently active within the enterprise network.
Claims22
A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
- storing an entity model for an entity at a threat management facility for an enterprise network, the entity including at least one of an identity and access management system, a domain controller, a physical device, a user, an operating system, or an application associated with the enterprise network, and the entity model characterizing a baseline of expected events based on events from the entity over an historical window as a vector in an event vector space;
- instrumenting a compute instance associated with the entity to report event vectors based on one or more events from one or more sensors associated with the compute instance;
- receiving an event stream at the threat management facility, the event stream including a plurality of event vectors from the compute instance;
- calculating a risk score for the compute instance based on a distance between the entity model and one or more event vectors in the event stream in the event vector space;
- and
- selecting a remedial action for the compute instance when the risk score exceeds a threshold.
A method comprising:
- storing an entity model at a threat management facility for an enterprise network, the entity model characterizing expected events for an entity;
- instrumenting a compute instance in the enterprise network to detect one or more events and report a number of event vectors including the one or more events to the threat management facility;
- receiving an event stream of the number of event vectors from the compute instance at the threat management facility;
- calculating a risk score for the compute instance based on a comparison of one or more of the number of event vectors in the event stream with the entity model for the entity;
- and
- selecting a remedial action for the compute instance based on the number of event vectors when the risk score for the entity exceeds a threshold.
A system comprising:
- a compute instance in an enterprise network, the compute instance configured to detect one or more events associated with the compute instance and report an event vector including the one or more events to a remote resource;
- and
- a threat management facility, the threat management facility including a memory storing an entity model characterizing expected events for an entity, and the threat management facility configured to receive an event stream including the event vector, to calculate a risk score for the compute instance based on a comparison of the event vector with the entity model, and to select a remedial action for the compute instance based on the event vector when the risk score for the entity exceeds a threshold.
Dependencies are inferred from the claim text.