Back to results
US 9,871,826 B1Granted
Sensor based rules for responding to malicious activity
AssigneeAnalyst Platform, LLC
InventorsRussell Scott Messick, Jason Daniel Smith
Life of this patent
Estimating the term…
Abstract
Systems and techniques are provided for creating sensor based rules for detecting and responding to malicious activity. Evidence corresponding to a malicious activity is received. The evidence corresponding to malicious activity is analyzed. Indicators are identified from the evidence. The indicators are extracted from the evidence. It is determined that an action to mitigate or detect a threat needs to be taken based on the indicators and evidence. A sensor to employ the prescribed action is identified. Whether a sensor based rule meets a threshold requirement is validated. A configuration file used to task the sensor based rule to the identified sensor is created. The number of sensor based rule triggers is tracked.
Claims28
A computer-implemented method comprising:
- receiving, at a computing device, an evidence corresponding to a malicious activity, wherein the evidence is received from an external computing device and is stored in a file by the computing device;
- extracting, by the computing device with an extraction engine, one or more indicators from the evidence by analyzing the contents of the file in which the evidence was stored;
- creating, with the computing device, a sensor based rule from the one or more indicators;
- bidirectionally linking, by the computing device, the one or more indicators extracted from the evidence to the evidence from which the indicators were extracted, wherein the linking is to the evidence stored in the file by the computing device and establishes a bidirectional linkage between the one or more indicators and the evidence from which the indicators were extracted, wherein the bidirectional linkage between the one or more indicators and the evidence is used to determine that the one or more indicators were extracted from the evidence;
- bidirectionally linking the sensor based rule to the evidence it originated from, wherein the linking establishes a bidirectional linkage between the sensor based rule and the evidence wherein the bidirectional linkage between the sensor based rule and the evidence is used to determine that the sensor based rule originated from the evidence;
- bidirectionally linking the sensor based rule to the indicator it originated from, wherein the linking establishes a bidirectional linkage between the sensor based rule and the indicator wherein the bidirectional linkage between the sensor based rule and the indicator is used to determine that the sensor based rule originated from the indicator;
- and
- creating a sensor configuration for tasking the sensor based rule to a sensor of an intrusion prevention or intrusion detection system, wherein the sensor monitors one or more of the computer system and a network infrastructure to which the computer system is connected.
5 more elements
A computer-implemented system for sensor based rules for responding to malicious activity comprising:
- a storage comprising at least one evidence, at least one indicator object, and at least one sensor based rule;
- and
- an analyst system comprising an ingestion engine, an extraction engine, a rule editor, and a rule engine, the ingestion engine configured to receive the at least one evidence corresponding to a malicious activity from an external computing device, store the at least one evidence corresponding to the malicious activity in a file, and analyze the at least one evidence corresponding to the malicious activity, the extraction engine configured to extract at least one indicator from the at least one evidence by analyzing the file in which the at least one evidence is stored, a rule editor to create the at least one sensor based rule from the at least one indicator, the rule engine configured to validate whether the at least one sensor based rule meets a threshold requirement, the analyst system configured to bidirectionally link the at least one indicator to the at least one evidence from which the at least one indicator was extracted wherein the link is to the at least one evidence stored in the file and establishes a bidirectional linkage between the at least one indicator and the at least one evidence from which the at least one indicator was extracted, wherein the bidirectional linkage between at least one indicator and the at least one evidence is used to determine that the at least one indicator was extracted from the at least one evidence, bidirectionally link the at least one sensor based rule to the at least one evidence it originated from, wherein the linking establishes a bidirectional linkage between the at least one sensor based rule and the at least one evidence wherein the bidirectional linkage between the at least one sensor based rule and the at least one evidence is used to determine that the at least one sensor based rule originated from the at least one evidence, bidirectionally link the at least one sensor based rule to the at least one indicator it originated from, wherein the linking establishes a bidirectional linkage between the at least one sensor based rule and the at least one indicator wherein the bidirectional linkage between the at least one sensor based rule and the at least one indicator is used to determine that the sensor based rule originated from the at least one indicator, and create a sensor configuration used to task the sensor based rule to a sensor of an intrusion prevention or intrusion detection system, wherein the sensor monitors one or more of the analyst system and a network infrastructure to which the analyst system is connected.
A system comprising:
- one or more computers and one or more storage devices storing instructions which are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
- receiving, at a computing device, an evidence corresponding to a malicious activity, wherein the evidence is received from an external computing device and is stored in a file by the computing device;
- extracting, by the computing device with an extraction engine, one or more indicators from the evidence by analyzing the contents of the file in which the evidence was stored;
- creating, with the computing device, a sensor based rule from the one or more indicators;
- bidirectionally linking, by the computing device, the one or more indicators extracted from the evidence to the evidence from which the indicators were extracted, wherein the linking is to the evidence stored in the file by the computing device and establishes a bidirectional linkage between the one or more indicators and the evidence from which the indicators were extracted, wherein the bidirectional linkage between the one or more indicators and the evidence is used to determine that the one or more indicators were extracted from the evidence;
- bidirectionally linking the sensor based rule to the evidence it originated from, wherein the linking establishes a bidirectional linkage between the sensor based rule and the evidence wherein the bidirectional linkage between the sensor based rule and the evidence is used to determine that the sensor based rule originated from the evidence;
- bidirectionally linking the sensor based rule to the indicator it originated from, wherein the linking establishes a bidirectional linkage between the sensor based rule and the indicator wherein the bidirectional linkage between the sensor based rule and the indicator is used to determine that the sensor based rule originated from the indicator;
- and
- creating a sensor configuration for tasking the sensor based rule to a sensor of an intrusion prevention or intrusion detection system, wherein the sensor monitors one or more of the computer system and a network infrastructure to which the computer system is connected.
6 more elements
Dependencies are inferred from the claim text.