Remediation of entities outside range of alarms

Abstract

Embodiments of the present disclosure relate to remediation of entities outside of the range of an alarm. In some examples, a security system detects an alert generated in response to an operation on a device, the operation involving a first process and a first entity. In response to the alert, the security system discovers a second entity outside of the range of the alert and applies remedial actions for the first process, the first entity and the second entity to address the alert.

Description

Background Art

[0001] Electronic devices may experience various security issues that may result in malfunction of the electronic device or loss or theft of data. For example, the electronic device may be the target of attacks by various malicious entities including humans, programs (e.g., viruses, worms, ransomware, etc.) and / or machines. Other types of security issues that electronic devices may experience include: the electronic device accesses potentially malicious or infected online resources (e.g., websites with low reputation scores, certain social media websites, etc.), the electronic device transmits sensitive data in an unsecured manner or transmits sensitive data with unauthorized entities, the electronic device accesses programs on unknown networks, the electronic device updates a program to a specific version or fails to update a program to a specific version, and so on. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] Some implementations of the present disclosure are described with respect to the following figures.

[0003] Figure 1 is a block diagram of an example arrangement including a security system coupled to various electronic devices, according to some examples.

[0004] Figure 2-Figure 3 is a diagram illustrating an example of an intelligent response of a security system to a corresponding alarm according to some implementations of the present disclosure.

[0005] Figure 4 is a block diagram of a security system coupled to an electronic device according to some examples.

[0006] Figure 5 is a flow diagram of a process according to some examples.

[0007] Throughout the drawings, the same reference numerals denote similar, but not necessarily identical, elements. The drawings are not necessarily drawn to scale, and the dimensions of some components may be exaggerated to more clearly illustrate the examples shown. In addition, the drawings provide examples and / or implementations consistent with the description; however, the description is not limited to the examples and / or implementations provided in the drawings. DETAILED DESCRIPTION

[0008] The security system may generate an alert in response to a detected event indicating a potential security issue. In some cases, the security system may include an endpoint security mechanism as part of an electronic device. The endpoint security mechanism runs locally in the corresponding electronic device to detect events indicating a potential security issue. Examples of endpoint security mechanisms may include malware scanners capable of detecting the presence of malware (e.g., viruses, worms, ransomware, etc.), user and entity behavior analysis (UEBA) mechanisms for detecting anomalies in the behavior of users or other entities, lateral movement detectors, etc.

[0009] An alert may be generated by the security system due to an operation in the electronic device, where the operation may include activities associated with one or more entities in the electronic device. An entity may include any one or some combination of a process, an object, a resource, a user, etc.

[0010] A "process" may refer to a program (including machine-readable instructions) being executed in an electronic device. A process in an electronic device may cause the execution of another process in the electronic device (or another electronic device).

[0011] In addition, a process can create or modify an object in an electronic device. As an example, an "object" can refer to an artifact, configuration information, a network connection, a scheduled task such as a queue, or an application programming interface (API) or library call, a user account.

[0012] An artifact may refer to a file, a database, or any other type of data that is created or modified (updated or deleted) as part of the operation of a process. Configuration information relates to the configuration of an electronic device or a component in an electronic device. In one example, a registry such as one associated with an operating system (OS) of an electronic device may include configuration information related to settings, options, or other values ​​for hardware and software components in the electronic device. A process may create a registry or modify a registry. A registry may include multiple registry entries related to different settings, options, or other values ​​for hardware and software.

[0013] A process can also establish, modify, or tear down network connections. In addition, a process can add scheduled tasks to a queue or make calls to an API or library.

[0014] A resource may refer to a website, a Domain Name System (DNS) server, or any other type of resource accessible to an electronic device. Files may be downloaded from a website. A process may interact with a website. An electronic device may interact with a DNS server to obtain an Internet Protocol (IP) address associated with a domain name. There are many other examples of resources that an electronic device may interact with.

[0015] When an alert based on the activity of a set of entities is generated in an electronic device, other entities may have been initiated, created, modified, or interacted with. Such other entities may pose security issues that may arise later. Although the alert may indicate that remedial action should be taken for the set of entities associated with the alert (e.g., a first process initiates a second process), the security system may not be able to resolve security issues posed by other entities outside the scope of the alert.

[0016] A group of entities is “associated with an alert” if activity involving the group of entities causes the security system (e.g., endpoint security engines 104-1 to 104-N and / or central security service 102) to issue an alert. Typically, an entity is “outside the scope” of an alert if an alert does not provide any indication of a security issue associated with the entity. For example, an alert may be raised when a first process starts a second process. After the alert is raised, the second process may start a third process, and the third process may create or modify an artifact. An artifact created or modified by the third process may be outside the scope of the alert because the artifact is not directly related to the first process or the second process (e.g., the artifact was not created or modified by the first process or the second process). Therefore, the alert may not indicate that the artifact poses a security issue. In another example, if a fourth process is part of a chain of entities that is separate from the chain of entities that includes the first process and the second process, the fourth process may be outside the scope of the alert.

[0017] As yet another example, a registry entry or other object may be outside the scope of an alert if it is created or modified by a different process than the first and second processes associated with the alert. If an entity outside the scope of the alert is not investigated for potential security issues, remedial actions are not applied to the entity, and the entity may later cause a malfunction in the electronic device or cause loss or theft of data.

[0018] According to some implementations of the present disclosure, a smart response security mechanism can determine remedial actions to be taken in response to an alarm generated due to operation of an electronic device. The smart response security mechanism can identify any entity outside the scope of the alarm and determine whether any remedial actions should be taken for such entity.

[0019] Figure 1 is a block diagram of an example arrangement including a security system for protecting various electronic devices. The security system includes a central security service 102 and endpoint security engines 104-1 to 104-N (N≥1) included in respective electronic devices 106-1 to 106-N.

[0020] Examples of electronic devices include any one or some combination of the following: desktop computers, notebook computers, tablet computers, server computers, smart phones, Internet of Things (IoT) devices, home appliances, gaming appliances, vehicles or vehicle controllers, storage systems, communication nodes, etc. For example, electronic devices 106-1 to 106-N may be located in a network of an enterprise. "Enterprise" may refer to a commercial company, an educational organization, a government agency, an individual, any user group, or any other organization. An enterprise network may include a local area network (LAN), a wide area network (WAN), etc. Some electronic devices may be coupled to an enterprise network via a public network such as the Internet.

[0021] The endpoint security engines 104-1 to 104-N run locally in the electronic devices 106-1 to 106-N to detect events indicating potential security issues. Examples of endpoint security engines may include malware scanners capable of detecting the presence of malware (e.g., viruses, worms, ransomware, etc.), user and entity behavior analysis (UEBA) mechanisms for detecting anomalies in the behavior of users or other entities, lateral movement detectors for detecting lateral movement of attacking entities moving across electronic devices in a network, and the like.

[0022] Each endpoint security engine 104-i (i=1 to N) can be implemented using one or more agents, where "agent" can refer to a software module executed in the electronic device 106-i to perform security functions. The (multiple) agents of the endpoint security engine can be executed on a hardware processing circuit, which can include any one or some combination of a microprocessor, a core of a multi-core microprocessor, a microcontroller, a programmable integrated circuit, a programmable gate array, or another hardware processing circuit.

[0023] exist Figure 1 In the example of , endpoint security engines 104-1 to 104-N can interact with a central security service 102 to enable the central security service 102 to provide protection for multiple electronic devices. A "central" security service can refer to any service that can interact with one or more electronic devices to provide security services to protect the one or more electronic devices from attacks. The central security service can be provided in the cloud, at a server, or at any other centralized location that allows the central security service to interact with multiple electronic devices.

[0024] According to some implementations of the present disclosure, each endpoint security engine 104-i includes a corresponding intelligent response module 108-i. Each intelligent response module 108-i may include machine-readable instructions as part of the corresponding endpoint security engine 104-i.

[0025] The central security service 102 also includes an intelligent response module 110. The intelligent response module (any one or some combination of 108-1 to 108-N and 110) is capable of detecting an alarm that has been generated in one or more electronic devices, identifying any entities outside the scope of the alarm, and determining whether any remedial action should be taken for such entities outside the scope of the alarm. Alarms can be generated by the security system (central security service 102 and / or endpoint security engines 104-1 to 104-N) based on alarm generation rules. In some examples, the security system can apply machine learning to generate alarms.

[0026] Each electronic device 106-i also includes a corresponding hardware processor 112-i, memory 114-i, storage media 116-i, and a communication interface 118-i. The communication interface 118-i allows the electronic device 106-i to communicate over a network, such as with the central security service 102 or with another electronic device.

[0027] The program is executed on the processor 112-i in the electronic device 106-i. Figure 1 Only one hardware processor is depicted in FIG. 1 , but the electronic device 106-i may include multiple hardware processors. Programs executable on the hardware processor 112-i include an operating system (OS) 120-i, firmware (FW) 122-i (e.g., basic input / output system (BIOS) code), and application programs (App) 124-i. Processes in the electronic device 106-i include processes associated with the OS 120-i, firmware 122-i, application programs 124-i, or any other program executed in the electronic device 106-i.

[0028] The hardware processor may include a microprocessor, a core of a multi-core microprocessor, a microcontroller, a programmable integrated circuit, a programmable gate array, or another hardware processing circuit. The memory may be implemented using one or more memory devices, such as a dynamic random access memory (DRAM) device, a static random access memory (SRAM) device, a flash memory device, and the like.

[0029] The storage medium may include persistent storage, such as one or more disk-based storage devices, solid-state drives, etc. The communication interface may include a transceiver for sending and receiving signals, and any protocol layers (implemented using machine-readable instructions and / or hardware) for implementing a communication protocol associated with communications over the network.

[0030] Figure 2 is an example diagram illustrating various entities involved in the operation of electronic device 106, which may be Figure 1 Any electronic device among electronic devices 106-1 to 106-N. Figure 2 In the example of , process P1 starts process P2. For example, process P1 can issue a command to start process P2. The endpoint security engine 104 (any of endpoint security engines 104-1 to 104-N) in the electronic device 106 can issue an alert 202 based on the information associated with process P2 starting process P1 meeting the security alert criteria. For example, the security alert criteria can specify that during a specific time interval or under conditions currently existing in the electronic device 106, a process of a given first program should not start a process of a given second program.

[0031] like Figure 2As further shown in , process P2 starts process P3, which in turn creates or modifies file 204 (an example of an artifact). Processes P1 to P3 and file 204 are part of a chain 206 of directly related entities, where the chain includes a sequence of entities that are created or modified in the order depicted (either chronological or causal order). A chain of "directly related entities" refers to entities where there is a direct relationship between consecutive entities in the sequence. A direct relationship exists between a first entity and a second entity if the first entity affects the operation of the second entity (e.g., one process starts another process) or the first entity creates or modifies the second entity, or if the second entity affects the operation of the first entity or the second entity creates or modifies the first entity.

[0032] Figure 2 Another chain 208 of directly related entities is shown, including processes P1 , P4 , and P5 (eg, P1 starts P4 , which starts P5 ). Figure 2 Another chain 210 of directly related entities is also shown, chain 210 includes file 204, processes P6, P7, P8, and P9, and registry 212. In some examples, if file 204 contains an image (including machine-readable instructions) for process P6, then file 204 can be directly related to process P6. In other words, file 204 contains machine-readable instructions of a program that, when executed, generates process P6. In chain 210 of directly related entities, process P6 starts process P7, process P7 starts process P8, and process P7 starts process P9. Process P9 updates registry 212, such as by adding or modifying an entry of registry 212.

[0033] By the time alert 202 is generated, process P3 may have been started, and file 204 may have been created by process P3. File 204 may have caused the start of process P6, which triggers corresponding processes P7, P8, and P9, as well as the modification of registry 212.

[0034] exist Figure 2 In the example of FIG. 2 , processes P1 and P2 are associated with alert 202 because process P1 initiated process P2, causing endpoint security engine 104 to issue alert 202. Process P3 is within the scope of alert 202 because process P3 is initiated by process P2, which is associated with alert 202. However, in chain 206 of directly related entities, file 204 is outside the scope of alert 202 because file 204 is not directly related to processes P1 and P2 associated with alert 202.

[0035] Even if remedial actions are to be applied to processes P1, P2, and P3 (which are processes within the scope of alert 202) (e.g., by terminating processes P1, P2, and P3), conventional security systems may not be able to make the following determination: the remedial action should be applied to file 204 outside the scope of alert 202. Similarly, conventional security systems may not be able to make the following determination: the remedial action should be applied to processes P4, P5, P6, P7, P8, P9, and registry 212, which are also outside the scope of alert 202.

[0036] If remedial action is not taken for entities outside the scope of alert 202, security issues may arise later because one or more of files 204, processes P4, P5, P6, P7, P8, P9, and registry 212 may cause a malfunction in electronic device 106 or cause data in electronic device 106 to be lost or stolen.

[0037] A human analyst may manually study the operation of the electronic device 106 to try to find out which entities may be outside the scope of the alert 202 and whether any remedial actions should be taken. However, such manual analysis is time consuming, and the human analyst may miss certain entities that may be malicious. In addition, the time delay involved in performing manual analysis may allow malicious entities to perform their corresponding activities in the electronic device 106.

[0038] According to some implementations of the present disclosure, the smart response module 108 in the electronic device 106 (which can be any one of the smart response modules 108-1 to 108-N) can automatically determine appropriate remedial actions to handle entities outside the scope of the alert 202. The smart response module 108 is capable of discovering all malicious parent processes, child processes, sibling processes, other indirectly related processes, objects, and resources that may be directly or indirectly related to the alert 202. The smart response module 108 can dynamically determine appropriate remedial actions for each corresponding entity based on the type of the corresponding entity, the relationship of the corresponding entity to the entity associated with the alert, the context of the alert, the customer's expected remedial action indication (for example, the smart response module can be provided with information of the preferred remedial action from the user of the electronic device), etc. In this way, the smart response module 108 can eliminate the burden on the user and can also automatically handle remedial actions that are to be applied to downstream threats that cannot be known at the time of the alert. The remedial actions to be applied can be based on predefined rules or based on applied machine learning.

[0039] Although the present example involves intelligent response module 108 making a determination of what remedial action to apply in response to an alert, in some other examples, intelligent response module 110 in central security service 102 may make a determination of what remedial action to apply in response to an alert. In still other examples, the determination of the remedial action to apply may be based on collaboration between multiple intelligent response modules (any combination of 110 and 108-1 to 108-N).

[0040] The remedial action to be applied may be based on the type of entity. For example, a remedial action for a process may include a terminate action that stops the execution of the process and tear down the process so that the process cannot be restarted again.

[0041] Remedial actions for an artifact such as a file can be any one or some combination of: delete (to remove the artifact from storage), quarantine (to place the artifact in an isolated location to prevent access to the artifact and prevent the artifact from triggering any activities), rollback (to put the artifact in a previous state, such as restoring a version of a file to a previous version), add to watch list (to place the artifact on a list to be monitored), and so on.

[0042] The remedial action for a resource such as a website, domain, etc. can be any one or some combination of the following: terminating the connection to the resource, blocking the resource, blocking an IP address associated with the resource, adding the resource to a watch list, and so on.

[0043] A remedial action for configuration information (eg, a registry or a registry entry) is to restore the configuration information from a current state to a previous state, or to delete the configuration information.

[0044] The remedial action for the user is to prevent the user from accessing the electronic device or network, such as by invalidating the user's credentials or locking the user account.

[0045] In some examples, each type of entity can be associated with a set of potential remedial actions that can be applied. The set of potential remedial actions associated with each type of entity can be stored in a data structure (e.g., a database, library, etc.) accessible to the smart response module.

[0046] Examples of relationships between entities may include parent, child, and sibling relationships. A "parent" process may be a process that starts another process. Figure 2 In the example of , process P1 is the parent of process P2, and process P2 is the parent of process P3. A "child" process is a process started by another process. Figure 2In the example of , process P2 is a child process of process P1, and process P3 is a child process of process P2. The parent process and the child process have a direct lineage relationship with each other. If a remedial action is to be applied to the parent process (e.g., shutting down the parent process), the intelligent response module 108 will also determine that the same remedial action will be applied to the child process based on the direct lineage relationship.

[0047] More generally, a “lineage relationship” may refer to a link between entities that is part of a chain of directly related entities, such as chain 206. Figure 2 If the graph of is a tree, then the links 206, 208 and 210 are branches of the tree. The entities in the branches of the tree have direct lineage relationships with each other.

[0048] "Sibling" processes are processes that share a common parent. Figure 2 In the example of , process P2 and process P4 are sibling processes because they share a common parent process P1. Processes P3 and P5 are also sibling processes because they share a common grandparent process P1. Processes P2 and P4 have a sibling relationship with each other. Similarly, processes P3 and P5 have a sibling relationship with each other. Based on the sibling relationship, if a remedial action is identified for process P2, then the intelligent response module 108 will determine that the remedial action must be applied to process P4.

[0049] Another type of relationship includes a relationship in which a process is generated based on an artifact (e.g., a file containing an image of a process), or a relationship in which the behavior of a process is affected by another object (e.g., a registry entry). Such relationships are examples of functional relationships between different types of entities (process and artifact, or process and registry).

[0050] Another type of relationship is an interactive relationship, such as in the example of downloading a file from a website or obtaining a file from another resource, or where a process interacts with a website or another resource.

[0051] Although some examples of relationships are indicated above, many other types of relationships may exist between entities. Remedial actions may be applied based on the relationships between entities.

[0052] The context of the alert may include any one or some combination of the severity of the alert, the risk of the alert, the uniqueness of the anomaly associated with the alert, the intelligence associated with the alert, and the like. The security system (e.g., endpoint security engines 104-1 to 104-N and / or central security service 102) may classify the severity of the alert into a plurality of severity categories (e.g., high, medium, low, or a value from a numerical range). The severity category of the alert may be based on the type of activity involved between the entities that caused the alert. For example, a modification to a registry entry of an OS may be classified as a high severity category, while sending an email may be classified as a low severity category.

[0053] The security system can classify the risk of the alarm into multiple risk categories (e.g., high, medium, low, or a value from a numerical range). If the alarm is part of a collection of alarms that occurred within a relatively short amount of time, the security system can classify the alarm as having a high risk. However, if the alarm is an individual alarm, and no other alarms were issued at a time close to the alarm, the security system can classify the alarm as having a low risk.

[0054] The security system may classify the uniqueness of an alarm based on an abnormal pattern associated with the alarm. The abnormal pattern includes a pattern of the types of entities and activities involved in causing the alarm. The pattern may be compared to patterns encountered in the past. If the pattern has not been encountered before or is encountered with relatively low frequency, the security system may classify the uniqueness of the alarm as high. On the other hand, if the pattern has been encountered frequently in the past, the security system may classify the uniqueness of the alarm as low. For example, information of patterns that have been encountered may be stored in a database and compared with newly encountered patterns that cause the alarm.

[0055] The intelligence associated with an alert can refer to threat intelligence. In some examples, definitions of threat intelligence can be provided by an open source knowledge base (such as MITRE ATT&CK). Alternatively, definitions of threat intelligence can be provided by a proprietary knowledge base available via a paid subscription, such as the Cylance Cyber ​​Threat Intelligence Report from BlackBerry. Definitions of threat intelligence can be available from other sources. Generally speaking, threat intelligence includes a list of known bad indicators of compromise (IOCs), which can include any one or some combination of the following: a cryptographic hash of a file, a file path, a registry key, a domain name, an IP address, and so on. Any alert involving an entity with a known bad IOC can be considered a higher risk alert.

[0056] exist Figure 2 In the example of FIG. 1 , the smart response module (any one or some combination of 110 and 108-1 to 108-N) may determine the Figure 2The following potential remediation actions for the various entities shown in : terminating processes P1 to P9, quarantining file 204, and restoring registry 212.

[0057] Based on the context of alert 202, the smart response module can determine whether to be more lenient or less lenient. Being more lenient will cause the smart response module to apply remedial actions to a smaller set of entities, or to apply less stringent remedial actions, while being less lenient will cause the smart response module to apply remedial actions to a larger set of entities, or to apply more stringent remedial actions.

[0058] Less stringent remediation actions may include adding the artifact to a watch list instead of deleting or restoring the artifact. More stringent remediation actions may include: deleting the artifact instead of just isolating the artifact, isolating the electronic device to prevent any communication to or from the electronic device, shutting down the electronic device, locking a user account.

[0059] Figure 3 is another example diagram illustrating various entities involved in the operation of the electronic device 106 . Figure 3 The diagram includes Figure 2 , the processes P1 to P9, the file 204 and the registry 212 shown in FIG. Figure 3 The diagram includes a file 302 downloaded from a website 304 . Figure 3 202 also includes process P10 that interacts with website 304 via a network connection. File 302 may contain an image of process P1. Intelligent response module 308 (either by itself or in collaboration with another intelligent response module such as 110) may identify additional entities (302, 304, P10) in response to alert 202. Intelligent response module 308 may also determine remedial actions to be taken with respect to the additional entities, including, for example, quarantining file 302, blocking website 304, and terminating the network connection between process P10 and website 304.

[0060] Figure 4 is included for protecting electronic device 406 (e.g., Figure 1 The security system 400 includes a central security service 102 (which includes an intelligent response module 110) and an endpoint security engine 104 (which includes an intelligent response module 108). Figure 4 Only one endpoint security engine 104 is depicted in FIG. 4 , but multiple endpoint security engines may exist in the corresponding multiple electronic devices 406 .

[0061] The security system 400 includes one or more hardware processors 402 and a memory 404. The central security service 102 and the endpoint security engine 104 are executable on the one or more hardware processors 402. Note that the endpoint security engine 104 is executable on one or more processors in the electronic device 406, and the central security service 102 is executable on one or more processors in a computer (or collection of computers) separate from the electronic device 406. Machine-readable instructions of the central security service 102 and the endpoint security engine 104 may be stored in a non-transitory machine-readable or computer-readable storage medium 408, and the machine-readable instructions may be retrieved from the storage medium 408 for execution on the one or more hardware processors 402.

[0062] In some examples, the machine-readable instructions of security system 400 are executable to detect an alarm generated in response to an operation on electronic device 406, where the operation involves a set of entities (e.g., a first process and a first entity). The first entity can be another process, an object, a resource, or a user.

[0063] In response to the alert, the machine-readable instructions discover a second entity outside of the scope of the alert, and the machine-readable instructions apply a remedial action to at least the first process, the first entity, and the second entity to address the alert.

[0064] More generally, the machine-readable instructions are capable of discovering an attack chain in response to an alert, wherein the attack chain includes the set of entities associated with the alert and other entities outside the scope of the alert. The machine-readable instructions determine remediation actions to be applied to entities of the attack chain based on multiple factors, including any one or some combination of the following: a type of each respective entity in the attack chain, a relationship of the respective entity to an entity associated with the alert, a context of the alert, an intended remediation action instruction of a customer, and the like.

[0065] In one example, the second entity is out of scope for the alert based on: (1) the first entity is the second process, (2) the alert is raised in response to the first process launching the second process, and (3) the second entity is a different entity type than the process (e.g., object, resource, user, etc.). In another example, the second entity is out of scope for the alert based on the second entity being separated from a chain of directly related entities, the chain of directly related entities including the first process and the first entity. For example, the chain of directly related entities is a first tree branch of directly related entities (e.g., Figure 2 206 in ), and the second entity is in a second tree branch of directly related entities (e.g., Figure 2 208 or 210).

[0066] There may be many other examples of entities outside the scope of an alert, including those discussed further above.

[0067] In some examples, discovery of the second entity is based on detecting that the second entity is associated with an artifact (e.g., Figure 2 204): The process is part of a chain (eg, 206) of directly related entities including a first process (eg, P1) and a first entity (eg, P2).

[0068] In another example, the second entity is a resource (e.g., Figure 3 304 in the website, and discovering the resource is based on detecting that a file including the following image is obtained from the resource (e.g. Figure 3 302), the image comprising machine-readable instructions for a first process.

[0069] In an additional example, the second entity is a second process, and the second process is discovered based on detecting that the first process and the second process have a common parent. The common parent can be an OS component that starts the first process and the second process, a file shared by the first process and the second process, a web server that starts the first process and the second process, a registry entry that both the first process and the second process interact with, and the like.

[0070] In some examples, the alert is in the first device (electronic device), and the discovery of the second entity is through a central service (e.g., Figure 1 For example, the central service discovers the second entity based on information collected from multiple devices connected to the central service. As another example, the second entity is in a second device different from the first device.

[0071] In some examples, the machine-readable instructions of security system 400 may confirm that all entities in the attack chain (such as Figure 2 or Figure 3 All entities shown in ) have taken remedial action.

[0072] In some examples, the machine-readable instructions of the security system 400 may determine that the primary remedial action is not possible for the second entity. In response to this determination, the machine-readable instructions of the security system 400 may identify a secondary remedial action to be applied to the second entity. For example, the second entity may be a user, and the primary remedial action may be to log the user out of all user accounts and force the use of a second factor authentication after the user is logged out. The user account management system responsible for applying the primary remedial action may be unable to respond (e.g., the user account management system is busy or down, or is compromised by an attacker). The machine-readable instructions of the security system 400 may identify another management system that is capable of disconnecting the user's access to the electronic device. The secondary remedial action in this example is to use the other management system to disconnect the user's access to the electronic device.

[0073] In other examples, in response to determining that a primary remedial action is not available, other secondary remedial actions may be applied.

[0074] In some examples, the machine-readable instructions of security system 400 may determine the correct order of remediation actions to be applied to entities of the attack chain in response to an alert. Figure 3 In the example embodiment, it may be optimal to first block website 304 and any interaction with website 304 to prevent any additional damaged files from being downloaded. Next, security system 400 may quarantine or delete files 204 and 302 to prevent additional processes from being generated from damaged files 204 and 302. Security system 400 may then terminate the process.

[0075] Figure 5 5 is a flow chart of a process 500 according to some examples, which may be performed by a security system. The process 500 includes: (at 502) detecting an alarm generated in response to an operation on an electronic device, wherein the operation involves a set of entities associated with the alarm. The entities may include any one or some combination of processes, objects, resources, users, etc.

[0076] Process 500 includes: discovering (at 504) an attack chain in response to the alert, the attack chain including the set of entities and additional entities outside the scope of the alert. Process 500 includes: determining (at 506) remediation actions to be applied to entities of the attack chain based on a plurality of factors. The factors may include any one or some combination of: a type of each respective entity in the attack chain, a relationship of the respective entity to an entity associated with the alert, a context of the alert, a customer's intended remediation action instructions, and the like.

[0077] Process 500 includes applying remediation actions (at 508) to entities of the attack chain. Examples of remediation actions that may be applied include any one or some combination of: terminating a process, deleting, quarantining, or rolling back a file, adding an entity to a watch list, terminating a connection to a resource, blocking a resource, blocking an IP address associated with a resource, restoring configuration information from a current state to a previous state, deleting configuration information, blocking a user from accessing an electronic device or network, and the like.

[0078] Storage media (e.g. Figure 1 116-1 to 116-N or Figure 4408) may include any one or some combination of the following: semiconductor memory devices, such as dynamic or static random access memory (DRAM or SRAM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), and flash memory or other types of non-volatile memory devices; magnetic disks, such as fixed disks, floppy disks, and removable disks; another magnetic medium, including tape; optical media, such as compact disks (CDs) or digital video disks (DVDs); or another type of storage device. Note that the instructions discussed above may be provided on one computer-readable or machine-readable storage medium, or alternatively, may be provided on multiple computer-readable or machine-readable storage media distributed in a large system that may have multiple nodes. One or more such computer-readable or machine-readable storage media are considered to be part of an article (or product). An article or product may refer to any manufactured single component or multiple components. One or more storage media may be located in a machine that runs machine-readable instructions, or at a remote site from which machine-readable instructions may be downloaded over a network for execution.

[0079] In the present disclosure, the use of the terms "a", "an" or "the" is also intended to include plural forms, unless the context clearly indicates otherwise. In addition, the terms "comprises", "comprising" or "having" when used in the present disclosure specify the presence of the elements described, but do not exclude the presence or addition of other elements.

[0080] In the foregoing description, many details are set forth to provide an understanding of the subject matter disclosed herein. However, implementations may be practiced without some of these details. Other implementations may include modifications and variations to the details discussed above. The appended claims are intended to cover such modifications and variations.

Claims

1. A non-transitory machine-readable storage medium comprising instructions that, when executed, cause a system to: detecting an alert generated in response to an operation on a device, the operation involving a first process and a first entity; In response to the alert, discovering a second entity outside of a range of the alert; as well as A remedial action is applied to the first process, the first entity, and the second entity to resolve the alert.

2. The non-transitory machine-readable storage medium of claim 1 , wherein the second entity is outside the scope of the alert based on: the first entity is a second process, The alarm is raised in response to the first process initiating the second process, and The second entity has a different entity type than the process. 3 . The non-transitory machine-readable storage medium of claim 2 , wherein the entity type of the second entity is an artifact type, a registry type, or a resource type, and the second entity is an artifact, a registry, or a resource. 4 . The non-transitory machine-readable storage medium of claim 1 , wherein the second entity is outside the scope of the alert based on the second entity being separated from a chain of directly related entities including the first process and the first entity. 5 . The non-transitory machine-readable storage medium of claim 4 , wherein the chain of directly related entities is a first tree branch of directly related entities, and the second entity is in a second tree branch of directly related entities.

6. The non-transitory machine-readable storage medium of claim 1, wherein the discovery of the second entity is based on detecting that the second entity is related to an artifact generated by a process that is part of a chain of directly related entities that includes the first process and the first entity.

7. A non-transitory machine-readable storage medium according to claim 6, wherein the second entity is a second process, and the discovery of the second process is based on detecting that a file generated by the following process includes an image containing machine-readable instructions for the second process: the process is part of a chain of directly related entities including the first process and the first entity.

8. The non-transitory machine-readable storage medium of claim 1, wherein the second entity is a resource, and wherein the discovery of the resource is obtained from the resource based on detecting a file comprising an image containing machine-readable instructions for the first process. 9 . The non-transitory machine-readable storage medium of claim 1 , wherein the second entity is a second process, and wherein the discovery of the second process is based on detecting that the first process and the second process have a common parent.

10. The non-transitory machine-readable storage medium of claim 1, wherein the alert is in a first device and the discovery of the second entity is through a central service. 11 . The non-transitory machine-readable storage medium of claim 10 , wherein the central service discovers the second entity based on information collected from a plurality of devices connected to the central service. 12 . The non-transitory machine-readable storage medium of claim 11 , wherein the second entity is in a second device different from the first device. 13 . The non-transitory machine-readable storage medium of claim 12 , wherein the anomaly to be resolved by the remedial action is caused by a lateral movement between the first device and the second device.

14. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions, when executed, cause the system to: The remedial action to be applied is determined based on one or more of: a type of the second entity, a relationship of the second entity to an entity associated with the alert, a context of the alert, and an indication of a desired remedial action by a user.

15. The non-transitory machine-readable storage medium of claim 14, wherein the context of the alert comprises any one or some combination of the following: severity of the alert, risk of the alert, uniqueness of an anomaly associated with the alert, and intelligence associated with the alert.

16. The non-transitory machine-readable storage medium of claim 1, wherein the instructions, when executed, cause the system to: Confirming that remediation actions have been taken for entities of an attack chain, the attack chain including the first process, the first entity, and the second entity.

17. The non-transitory machine-readable storage medium of claim 1, wherein the instructions, when executed, cause the system to: determining that a primary remedial action is not possible for the second entity; and Responsive to the determination, a secondary remedial action to be applied to the second entity is identified.

18. The non-transitory machine-readable storage medium of claim 1, wherein the instructions, when executed, cause the system to: In response to the alert, a correct sequence of remediation actions to be applied to entities of an attack chain is determined, the attack chain including the first process, the first entity, and the second entity.

19. A security system, include: one or more processors; as well as a non-transitory storage medium storing instructions executable on the one or more processors to: detecting an alert generated in response to an operation on a device, the operation involving a set of entities associated with the alert; In response to the alert, discovering an attack chain, the attack chain including the set of entities and including additional entities outside of the scope of the alert; determining, based on a plurality of factors, a remediation action to be applied to an entity of the attack chain; as well as The remediation action is applied to the entity of the attack chain.

20. A method for a security system, the security system comprising a hardware processor, the method include: detecting an alert generated in response to an operation on a device, the operation involving a set of entities associated with the alert; In response to the alert, discovering an attack chain, the attack chain including the set of entities and including additional entities outside of the scope of the alert; determining, based on a plurality of factors, a remediation action to be applied to an entity of the attack chain; as well as The remediation action is applied to the entity of the attack chain.

Images