Remediation in response to alarm mode

Abstract

In some examples, a system detects a first alert associated with activity of a first group of entities, the first alert generated by a first type of security agent. The system predicts a set of alarms including one or more alarms expected to occur based on the occurrence of the first alarm, where a second alarm in the set of alarms is from a second type of security agent different from the first type of security agent. The system generates one or more remedial actions to apply in response to an alarm pattern that includes the first alarm and one or more alarms of the set of alarms. In an electronic device to be protected from an attack, the system provides information of one or more remedial actions to be applied by the electronic device in response to the occurrence of an alarm mode.

Description

Background Art

[0001] Electronic devices may encounter various security issues that may cause the failure of the electronic device or the loss or theft of data. For example, the electronic device may become the target of attacks by various malicious entities, including humans, programs (e.g., viruses, worms, ransomware, etc.) and / or machines. Other types of security issues that may be encountered by electronic devices include the electronic device accessing potentially malicious or infected online resources (e.g., websites with low reputation scores, certain social media websites, etc.), the electronic device transmitting sensitive data in an unsecured manner or with unauthorized entities, the electronic device accessing programs on unknown networks, the electronic device updating programs or failing to update programs to a specific version, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] Some implementations of the disclosure are described with reference to the following figures.

[0003] Figure 1 is a block diagram of an example arrangement including a central security service coupled to various electronic devices according to some implementations of the present disclosure.

[0004] Figures 2 to 3 is a chart illustrating examples of alarm patterns that may be predicted by a security system according to some implementations of the present disclosure.

[0005] Figure 4 is a block diagram of a security system according to some examples.

[0006] Figure 5 is a flow diagram of a process according to some examples.

[0007] Throughout the drawings, the same reference numerals denote similar, but not necessarily identical, elements. The drawings are not necessarily drawn to scale, and the sizes of some parts may be exaggerated to more clearly illustrate the examples shown. In addition, the drawings provide examples and / or implementations consistent with the description; however, the description is not limited to the examples and / or implementations provided in the drawings. DETAILED DESCRIPTION

[0008] The security system may generate an alert in response to a detected event indicating a potential security issue. In some cases, the security system may include an endpoint security mechanism as part of an electronic device. The endpoint security mechanism runs locally in the corresponding electronic device to detect events indicating a potential security issue. Examples of endpoint security mechanisms may include malware scanners capable of detecting the presence of malware (e.g., viruses, worms, ransomware, etc.), user and entity behavior analysis (UEBA) mechanisms for detecting anomalies in the behavior of users or other entities, lateral movement detectors, etc.

[0009] In some cases, the security system may also include one or more security mechanisms implemented in a central security service, such as in the cloud, in a server, or in any other centralized location that allows the central security service to interact with multiple electronic devices. The various security mechanisms implemented in the electronic devices and the central security service may include different types of security mechanisms that are configured to provide different types of protection against attacks.

[0010] An alert may be generated by the security system due to an operation in the electronic device, where the operation may include activities associated with one or more entities in the electronic device. Entities may include any or some combination of processes, objects, resources, users, etc.

[0011] A "process" may refer to a program (including machine-readable instructions) being executed in an electronic device. A process in an electronic device may cause execution of another process in the electronic device (or in another electronic device).

[0012] In addition, the process can create or modify an object in the electronic device. As an example, an "object" can refer to an artifact, configuration information, a network connection, a task such as a schedule in a queue, a call to an application programming interface (API) or library, a user account.

[0013] An artifact may refer to a file, a database, or any other type of data that is created or modified (updated or deleted) as part of the operation of a process. Configuration information relates to the configuration of an electronic device or a component in an electronic device. In an example, a registry (such as a registry associated with an operating system (OS) of an electronic device) may include configuration information related to settings, options, or other values ​​for hardware and software components in an electronic device. A process may create a registry or modify a registry. A registry may include multiple registry entries related to different settings, options, or other values ​​for hardware and software.

[0014] A process can also establish, modify, or tear down a network connection. In addition, a process can add scheduled tasks to a queue or make calls to an API or library.

[0015] A resource may refer to a website, a domain name system (DNS) server, or any other type of resource accessible by an electronic device. A file may be downloaded from a website. A process may interact with a website. An electronic device may interact with a DNS server to obtain an Internet Protocol (IP) address associated with a domain name. There are many other examples of resources with which an electronic device may interact.

[0016] When an alarm is generated, a remediation action may be taken to resolve the alarm. The security system may collect various data related to the operation of the electronic device for analysis to determine whether an attack is occurring (or may occur), and what remediation action (if any) to take in response to the alarm. The alarm provides an indication that a problem has been detected, which may indicate that an attack has occurred in the electronic device. In some examples, the collection of data may be triggered by the occurrence of one or more alarms. The collection of data triggered by one or more alarms may be in addition to the data collected in the electronic device as part of the operation of the electronic device.

[0017] Performing remedial actions in response to an alert is reactive in nature. By the time remedial actions are taken in response to an alert, the attack may have progressed to the point where damage has occurred in the electronic device or data has been accessed by an unauthorized attacker, which may be a person, program, or machine.

[0018] According to some implementations of the present disclosure, an active safety system is provided that can respond to a detected alarm by predicting a collection of one or more additional alarms. The active safety system uses the prediction to generate one or more remedial actions to be applied. The active safety system can take preventive or proactive remedial actions based on the predicted collection of one or more additional alarms. The preventive or proactive remedial actions provide enhanced protection for electronic devices from attacks to prevent malfunction of the electronic device or loss or theft of data in the electronic device.

[0019] Figure 1 is a block diagram of an example arrangement including an active security system to protect various electronic devices 106-1 to 106-N. The active security system includes a central security service 102 and endpoint security agents 104-1 to 104-N and 108-1 to 108-N (N≥1) included in respective electronic devices 106-1 to 106-N.

[0020] Examples of electronic devices include any or some combination of the following: desktop computers, notebook computers, tablet computers, server computers, smart phones, Internet of Things (IoT) devices, home appliances, gaming appliances, vehicles or vehicle controllers, storage systems, communication nodes, etc. For example, electronic devices 106-1 to 106-N may be located in a network of an enterprise. "Enterprise" may refer to a business organization, an educational organization, a government agency, an individual, any user group, or any other organization. An enterprise network may include a local area network (LAN), a wide area network (WAN), etc. Some electronic devices may be coupled to an enterprise network via a public network such as the Internet.

[0021] The endpoint security agents 104-1 to 104-N and 108-1 to 108-N run locally in the electronic devices 106-1 to 106-N to detect events that indicate potential security issues. An "agent" may refer to a software module that executes on a hardware processing circuit, which may include any or some combination of a microprocessor, a core of a multi-core microprocessor, a microcontroller, a programmable integrated circuit, a programmable gate array, or another hardware processing circuit.

[0022] exist Figure 1 In the example of , endpoint security agents 104-1 to 104-N and 108-1 to 108-N can interact with a central security service 102 to enable the central security service 102 to provide protection for multiple electronic devices. A "central" security service can refer to any service that can interact with one or more electronic devices to provide security services to protect one or more electronic devices from attacks. The central security service can be provided in the cloud, in a server, or in any other centralized location that allows the central security service to interact with multiple electronic devices.

[0023] In each electronic device, the type of endpoint security agent 104-i (i=1 to N) can be different from the corresponding endpoint security agent 108-i. Although only two different types of endpoint security agents are shown in each electronic device 106-i, in other examples, more than two different types of endpoint security agents can be included in the electronic device. In another example, the electronic device can include only one endpoint security agent.

[0024] Examples of different types of endpoint security agents may include any or some combination of the following: security agents that detect and block malware using specified rules or using machine learning to detect existing malware as well as new malware or new variants of existing malware; security agents that monitor and aggregate collected information to detect, track, and respond to malicious incidents; information protection agents that detect when sensitive data is accessed or sent to external destinations; and so on.

[0025] The security agent 110 may also be part of the central security service 102. The security agent 110 in the central security service 102 may provide protection based on information across multiple electronic devices, such as the electronic devices 106-1 to 106-N, and information from other sources in or outside the network. The security agent 110 is a different security agent than the endpoint security agents 104-1 to 104-N and 180-1 to 108-N.

[0026] According to some implementations of the present disclosure, the central security service 102 also includes an alert prediction module 150 and an active response module 154. Each of the modules 150 and 154 can be implemented using machine-readable instructions as part of the central security service 102. Although shown as two modules, in other examples, the alert prediction module 150 and the active response module 154 can be integrated into one module.

[0027] The alert prediction module 150 can predict a set of alerts (hereinafter referred to as an "alert set") based on detecting one or more alerts. The alert set can include one or more alerts. For example, the alert prediction module 150 can detect a first alert 140 associated with an activity of a first group of entities in one or more of the electronic devices 106-1 to 106-N. In some examples, the first alert 140 can be generated by a first type of security agent, such as any of the endpoint security agents 104-1 to 104-N and 108-1 to 108-N.

[0028] Based on the detected first alarm 140, the alarm prediction module 150 predicts an alarm set 152 including one or more predicted alarms. The alarm set 152 predicted by the alarm prediction module 150 may include a second alarm that is expected to be generated by a second type of security agent different from the first type of security agent.

[0029] The alarm set 152 is provided by the alarm prediction module 150 to the active response module 154, which generates one or more remedial actions 156 to be applied in response to an alarm pattern (the alarm pattern includes a first alarm followed by one or more alarms in the alarm set 152). The generation of the one or more remedial actions 156 to be applied can be based on policy information, which can come from a user, a program, or a machine. The policy information can specify that a more aggressive remedial action is applied under certain conditions. For example, if the alarm pattern includes a certain number of alarms, and a first subset (less than all) of the alarm pattern is detected, the policy information can specify that a less aggressive remedial action will be taken. On the other hand, if a second subset of alarms (including more alarms than the first subset of alarms) is detected, the policy information can specify that a more aggressive remedial action will be taken. Examples of more aggressive or less aggressive remedial actions are further provided below.

[0030] In addition, active response module 154 can provide information of one or more remedial actions 156 to electronic devices (including any one or more of electronic devices 106-1 to 106-N). Information of one or more remedial actions 156 can be applied by the electronic device in response to the electronic device detecting the occurrence of an alarm mode in the electronic device.

[0031] although Figure 1 The alert prediction module 150 and the active response module 154 are shown as part of the central security service 102, but in other examples, the alert prediction module 150 and / or the active response module 154 may be part of one or more of the electronic devices 106-1 through 106-N.

[0032] Each electronic device 106-i also includes a corresponding hardware processor 112-i, memory 114-i, storage media 116-i, and a communication interface 118-i. The communication interface 118-i allows the electronic device 106-i to communicate over a network, such as with the central security service 102 or with another electronic device.

[0033] The program is executed on the hardware processor 112-i in the electronic device 106-i. Although only one hardware processor Figure 1 1, but the electronic device 106-i may include multiple hardware processors. Programs that may execute on the hardware processor 112-i include an operating system (OS) 120-i, firmware 122-i (e.g., basic input / output system (BIOS) code), and application programs 124-i. Processes in the electronic device 106-i include processes associated with the OS 120-i, firmware 122-i, application programs 124-i, or any other program executed in the electronic device 106-i.

[0034] The hardware processor may include a microprocessor, a core of a multi-core microprocessor, a microcontroller, a programmable integrated circuit, a programmable gate array, or another hardware processing circuit. The memory may be implemented using one or more memory devices, such as a dynamic random access memory (DRAM) device, a static random access memory (SRAM) device, a flash memory device, etc.

[0035] The storage medium may include persistent storage, such as one or more disk-based storage devices, solid-state drives, etc. The communication interface may include a transceiver for sending and receiving signals, and any protocol layers (implemented using machine-readable instructions and / or hardware) for implementing a communication protocol associated with communication over the network.

[0036] Figure 2 is a diagram showing an example of how the alarm prediction module 150 generates an alarm set 152 based on the first alarm A1. Figure 2In the example of , the alarm prediction module 150 predicts that an alarm A2 may occur in a given context, and the given context includes the occurrence of an alarm A1. The context may also include other context information, including: the type of security agent that generates the alarm A1, the type of electronic device where the alarm A1 occurs, the state of the electronic device, information about the hardware being operated when the alarm occurs, information about one or more programs (including firmware, OS and / or applications) being executed when the alarm A1 occurs, the location associated with the alarm A1, the time associated with the alarm A1, information about the data accessed when the alarm A1 occurs, the type of entity associated with the alarm, the reputation score associated with the entity associated with the alarm, and the like.

[0037] The prediction of an alarm given a particular context (i.e., previous occurrences of one or more alarms and other contextual information) can be a signature-based prediction or a machine learning-based prediction. An example of a signature-based prediction is a rule-based prediction, where a prediction of a subsequent alarm (that has not actually occurred yet) is based on rule information including one or more rules, given that one or more previous alarms have occurred. For example, a rule may specify that if an alarm from a security agent of a given type for an event involves a particular type of program and / or a particular type of hardware, then it is likely (with a confidence level greater than a specified threshold) that another alarm will be generated, where the other alarm may be from a security agent of the given type or another type of security agent.

[0038] Another type of signature-based alert prediction is based on threat intelligence. For example, threat intelligence can define a specific attack flow, which is a data model that describes a sequence of attack behaviors. The description of an attack flow may include a sequence of actions and machine-readable representations of entities that may be involved in actions associated with the attack. The machine-readable representation may define causal relationships between actions and entities. In some examples, the attack flow may use an open source knowledge base such as MITRE ATT&CK.

[0039] In other examples, the alarm prediction module 150 uses machine learning to predict a subsequent one or more alarms that may occur given the occurrence of one or more previous alarms and other contextual information. Machine learning-based predictions use a machine learning model that can be trained using training data or using the results of previous predictions and feedback about whether the previous predictions were accurate. The machine learning model can also provide a measure that represents the likelihood of the predicted alarm. The measure that represents the likelihood of the predicted alarm provides an indication of the confidence that the predicted alarm will occur.

[0040] like Figure 2As further shown, given the context in which alarms A1 and A2 have been detected, the alarm prediction module 150 can predict that alarms A3 and A4 are likely to occur (with high confidence). In addition, the alarm prediction module 150 can also predict that alarm A5 is likely to occur (with high confidence) given the context in which alarms A1 to A4 have already occurred. If the metric representing the likelihood of predicting an alarm exceeds a specified threshold, "high confidence" can be indicated.

[0041] In general, alarms A2, A3, A4, and A5 constitute the alarm set 152 predicted by the alarm prediction module 150 in response to detecting the alarm A1. An "alarm pattern" includes alarm A1 followed by one or more alarms in the predicted alarm set 152, which includes alarms A2, A3, A4, and A5. Such an alarm pattern may represent an event related to an attack. For example, an alarm pattern may be an alarm sequence, such as any of the following: {A1, A2}, {A1, A2, A3}, {A1, A2, A4}, {A1, A2, A3, A5}, {A1, A3}, {A1, A4}, {A1, A3, A5}, {A1, A5}, or any other alarm combination including A1 followed by one or more of A2, A3, A4, or A5. Information representing the alarm pattern may include information identifying the source of the alarm (eg, which security agent generated the alarm) and the temporal relationship between the alarms (eg, A2 follows A1, A3 and A4 follow A2, and A5 follows A3).

[0042] Given an alarm pattern, the active response module 154 may generate one or more remedial actions 156 to address any or some combination of alarms in the alarm pattern. For example, the one or more remedial actions 156 generated by the active response module 154 may include remedial actions for addressing alarms A3, A4, and A5 (or any other subset of the alarm pattern).

[0043] Remedial action information 202 including information about (multiple) remedial actions 156 and alarm patterns can be sent (e.g., via a network) to the electronic device 106 (or multiple electronic devices) by the active response module 154. The electronic device saves the received remedial action information 202 (as saved remedial action information 204) in the memory 114 of the electronic device 106. The remedial action information can be in the form of a table or other type of data structure. For example, the remedial action information can include multiple entries, each of which associates an alarm with a corresponding remedial action to be taken for the alarm. In some cases, the entry associates an alarm sequence with a remedial action. Information including alarm A1 and the alarm patterns of the alarms in the alarm set 152 can also be saved in the electronic device 106, such as as part of the remedial action information 204 or as a separate information set in the memory 114.

[0044] For example, if the electronic device 106 detects an alarm sequence including A1, A2, and A3 or A4, the electronic device 106 can use the remedial action information 204 to quickly determine a remedial action to resolve the alarm A3 or A4. The remedial action information 204 can associate each alarm in the alarm pattern with a corresponding remedial action. For example, the remedial action information 204 can associate the alarm A3 with the remedial action R1, the alarm A4 with the remedial action R2, and the alarm A5 with the remedial action R3. When the alarm A3 is detected after the alarms A1 and A2 are detected, the electronic device 106 can access the remedial action information 204 to identify the remedial action R1 to be taken to resolve the alarm A3.

[0045] For example, accessing remedial action information 204 in response to detecting an alarm sequence including A1, A2, and A3 can be performed by a security agent (e.g., one of 104-1 to 104-N and 108-1 to 108-N). In a specific example, a first security agent 210 generates an alarm A1 and subsequently generates an alarm A2. For example, the occurrence of alarms A1 and A2 (along with other contextual information) can be stored by the first security agent 210 in alarm log information 214 (such as in memory 114). When a second security agent 212 (which can be different or the same as the first security agent 210) detects alarm A3, the second security agent 212 can access the alarm log information 214 to determine that alarms A1 and A2 were previously detected. Then, the second security agent 212 can determine that the alarm sequence A1, A2, and A3 matches a portion of the alarm pattern indicated by the remedial action information 204. For example, the second security agent 212 can compare the detected alarm to an alarm pattern that includes A1 and the alarms in the alarm set to determine whether the detected alarm follows a sequence that matches some portion of the alarm sequence represented in the alarm pattern. The second security agent 212 uses the remedial action information 204 to identify the remedial action R1 to be applied to the alarm A3 (based on the remedial action information 204 that associates the alarm A3 with R1). The occurrence of the alarm A3 can also be stored by the second security agent 212 in the alarm log information 214.

[0046] More generally, when the security agent detects a current alarm, the security agent accesses the alarm log information 214 to determine which previous alarms related to the given alarm have occurred (e.g., the security agent detects an alarm sequence that includes previous alarms and the current alarm). The security agent compares the alarm sequence (or any other set of detected alarms) to the alarm pattern identified by the remedial action information 204. If the alarm sequence matches a portion of the alarm pattern, the security agent identifies the remediation associated by the remedial action information 204 to the current alarm, and the security agent triggers execution of the identified remedial action in the electronic device 106.

[0047] The electronic device 106 does not have to wait for a security system (e.g., a security agent) to analyze the alert and the context surrounding the alert to generate remedial actions for the alert, which may take some time, which may allow an attack to progress in the electronic device 106 and cause the electronic device 106 to malfunction or data to be lost / theft.

[0048] Figure 3 is a diagram showing various entities involved in the operation of one or more electronic devices 300, including Figure 1 Any or some combination of electronic devices 106-1 to 106-N in the embodiment. Figure 3Operations are shown involving processes and artifacts, but it should be noted that in other examples, operations may involve other types of entities.

[0049] exist Figure 3 In the example of , process P1 starts process P2, which in turn creates artifact AF1. For example, process P1 can issue a command to start process P2. Artifact AF1 created by process P2 can be a file, for example.

[0050] Endpoint security agent 302 (any of endpoint security agents 104-1 through 104-N) can issue alert A1 based on context information indicating that process P2 (initiated by P1) created artifact AF1 according to security alert criteria. For example, the security alert criteria can specify that a process of a particular type of program initiated by a process of another type of program should not create an artifact of the type corresponding to AF1.

[0051] like Figure 3 As further shown in the example of , process P2 starts process P3, which in turn starts process P4. Process P4 starts process P5 and process P9. In addition, process P4 creates artifacts AF2, AF3, AF4, and AF5. Process P5 starts process P6, which starts process P7. Process P7 starts processes P8 and P10.

[0052] Process P9 creates artifact AF9, process P7 creates artifact AF8, and process P10 creates artifact AF7. Figure 3 As further shown, process P11 which has no direct relationship with any of processes P1 to P10 also creates artifact AF6. A first process is not directly related to a second process if the first process is not started or modified by the second process and vice versa.

[0053] Given alert A1, alert prediction module 150 predicts that alerts A2 and A3 are likely to be generated at some point in the future (with high confidence). For example, alert A2 may be generated by endpoint security agent 304 in response to detecting that process P11 has created artifact AF6 and based on having previously detected alert A1. Endpoint security agent 304 may be the same as or different from endpoint security agent 302. Additionally, alert A3 may be generated by endpoint security agent 306 in response to detecting that process P7 has created artifact AF8 and based on having previously detected alerts A1 and A2. Endpoint security agent 306 may be the same as or different from each of endpoint security agents 302 and 304. In some examples, endpoint security agents 302, 304, and 306 may be different types of security agents.

[0054] In response to the alarm pattern including A1, A2, and A3, the active response module 154 can send remedial action information 308 to one or more electronic devices 300, and the remedial action information 308 specifies one or more remedial actions to be applied. The remedial action information 308 can be stored in a memory 312 in the one or more electronic devices 300 as remedial action information 310. In examples involving multiple electronic devices, the memory 312 includes memory devices in the multiple electronic devices. In such examples, the active response module 154 sends the remedial action information 308 to the multiple electronic devices for storage in the corresponding memory devices.

[0055] When the endpoint security agent 304 detects the alarm A2, based on the alarm A2 occurring after the alarm A1, the endpoint security agent 304 can access the remediation action information 310 in the memory 312 to determine whether there is information for the alarm A2 in the remediation action information 310. If so, the endpoint security agent 304 can identify the remediation action taken for the alarm A2 specified in the remediation action information 310. The endpoint security agent 304 then triggers the application of the identified remediation action, which can be more efficient than the security agent 304 having to perform an analysis of the alarm A2 (possibly by consulting the central security service 102 ( Figure 1 ) to determine whether remedial action is to be applied) is executed more quickly.

[0056] Later, when endpoint security agent 306 generates alert A3, endpoint security agent 306 may similarly consult information of remedial action information 310 in memory 312 to identify what remedial action to apply based on alert A3 occurring after alerts A1 and A2.

[0057] Note that endpoint security agent 304 may apply a first remedial action in response to detecting alarms A1 and A2 but not detecting alarm A3. Endpoint security agent 306 may apply a second remedial action in response to detecting alarms A1, A2, and A3. In some examples, the first remedial action is less aggressive than the second remedial action. If the first remedial action causes less disruption in one or more electronic devices than the second remedial action, the first remedial action is less aggressive than the second remedial action.

[0058] Remedial actions can be applied to different entities. For example, a remedial action for a process can include a termination action that stops the execution of the process and dismantles the process so that the process cannot be restarted again. Another remedial action for a process can include pausing the process. Terminating a process is more radical (and therefore more destructive) than pausing a process because restarting a suspended process has less overhead than restarting a previously terminated process. For example, context information for a suspended process can be retained in a memory so that the context information can be used when the suspended process is restarted, while context information for a terminated process can be deleted from the memory.

[0059] Remedial actions for an artifact (such as a file) can be any or some combination of the following: delete (remove the artifact from storage), quarantine (place the artifact in an isolated location to prevent access to the artifact and prevent the artifact from triggering any activity), rollback (place the artifact in a previous state, such as reverting a version of a file to a previous version), add to a watch list (place the artifact in a list to be monitored), etc. Adding an artifact to a watch list is less aggressive than deleting the artifact.

[0060] Remedial actions for resources such as websites, domains, etc. may be any or some combination of: terminating connections to the resource, blocking the resource, blocking an IP address associated with the resource, adding the resource to a watch list, etc. Similarly, adding a resource to a watch list is less aggressive than other actions that may disrupt the operation of the resource.

[0061] The remedial action for configuration information (eg, a registry or a registry entry) is to restore the configuration information from a current state to a previous state, or to delete the configuration information. Restoring the configuration information to a previous state is less aggressive than deleting the configuration information.

[0062] The remedial action for the user is to block the user's access to the electronic device or network, such as by invalidating the user's credentials or locking the user's account, or temporarily suspending processing requests from the user. Temporarily suspending processing requests from the user is less aggressive than invalidating the user's credentials.

[0063] In another example, during operation of one or more electronic devices 300, alert A1 may be generated by endpoint security agent 302, and alert A3 may be generated by endpoint security agent 306. However, alert A2 is not generated by endpoint security agent 304. In such a scenario, endpoint security agent 306 may still apply a remedial action, but the remedial action specified by remedial action information 310 in the scenario where intermediate alert A2 is skipped is less aggressive than the remedial action in the scenario where all three alerts A1, A2, and A3 are detected.

[0064] Figure 4is a method for protecting an electronic device 406 (e.g., Figure 1 The security system 400 includes a central security service 102 (which includes an alarm prediction module 150 and an active response module 154) and an endpoint security agent 410 (e.g., Figure 1 As shown, 104-1 to 104-N and 108-1 to 108-N) are executed in the electronic device.

[0065] The security system 400 includes one or more hardware processors 402 and a memory 404. The central security service 102 and the endpoint security agent 410 are executable on the one or more hardware processors 402. Note that the endpoint security agent 410 is executable on the one or more hardware processors in the electronic device 406, and the central security service 102 is executable on one or more hardware processors in a computer (or collection of computers) separate from the electronic device 406. Machine-readable instructions of the central security service 102 and the endpoint security agent 410 can be stored in a non-transitory machine-readable or computer-readable storage medium 408, and the machine-readable instructions can be retrieved from the storage medium 408 to be executed on the one or more hardware processors 402.

[0066] In some examples, the machine-readable instructions of the security system 400 are executable to detect a first alarm associated with activity of a first group of entities, the first alarm generated by a security agent of a first type. An entity group is "associated with" an alarm if activity involving the entity group causes the security system to issue an alarm. An alarm indicates that a problem has been detected, which may indicate that one or more electronic devices are under attack.

[0067] The machine-readable instructions of the security system 400 also predict an alarm set (e.g., Figure 1 152), the alarm set includes one or more alarms that are expected to occur based on the occurrence of the first alarm. At least a second alarm in the alarm set comes from a second type of security agent that is different from the first type of security agent.

[0068] The machine-readable instructions of the security system 400 also generate one or more remedial actions (e.g., Figure 1 In one embodiment, the first alarm is applied in response to an alarm pattern, the alarm pattern including a first alarm followed by one or more alarms in an alarm set. A first remedial action may be applied by a second type of security agent in response to detecting that the second alarm is part of the alarm pattern to resolve the second alarm.

[0069] The machine-readable instructions of security system 400 also provide information, in an electronic device to be protected from attack, of one or more remedial actions to be applied by the electronic device in response to the occurrence of an alarm pattern.

[0070] In some examples, a third alarm in the set of alarms is from a third type of security agent, the third type of security agent being different from each of the first type of security agent and the second type of security agent. The third type of security agent in the electronic device applies a second remedial action in response to detecting occurrences of the first alarm and the third alarm.

[0071] In another example, a second type of security agent in the electronic device will apply a first remedial action in response to detecting a particular sequence of alarms occurring in the following order: a first alarm, a second alarm, and a third alarm.

[0072] In another example, the second type of security agent applies a second remedial measure in response to detecting the first alarm and the second alarm but not detecting the third alarm. In such a further example, the second remedial measure is less aggressive than the first remedial measure because the third alarm is skipped.

[0073] In some examples, a first security agent of one of the first type of security agent and the second type of security agent runs in a first electronic device, and a second security agent of the other of the first type of security agent and the second type of security agent runs outside the first electronic device (e.g., in the second electronic device or in a central cloud service).

[0074] The machine-readable instructions of the security system 400 may be a central security service (e.g., Figure 1 102) and / or may be part of one or more electronic devices 406.

[0075] Figure 5 According to some examples, a security system (e.g. Figure 4 400 in FIG. 4. Process 500 includes detecting (at 502) a first alert associated with an activity of a first group of entities, the first alert being generated by a security agent of a first type.

[0076] Process 500 includes predicting (at 504) a set of alarms including one or more alarms that are expected to occur based on an occurrence of a first alarm, wherein a second alarm in the set of alarms is from a second type of security agent different from the first type of security agent.

[0077] The process 500 includes generating (at 506) a remedial action to be applied in response to an alarm pattern, the alarm pattern including a first alarm and one or more alarms in an alarm set. The process 500 includes sending (at 508) from the security system to an electronic device to be protected from attack over a network: information of a remedial action to be applied by the electronic device in response to an occurrence of the alarm pattern, wherein the information of the remedial action includes an entry associating the remedial action to a corresponding alarm in the alarm pattern.

[0078] Storage media (such as Figure 4 408) may include any or some combination of the following: semiconductor memory devices, such as dynamic or static random access memory (DRAM or SRAM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), and flash memory or other types of non-volatile memory devices; disks, such as fixed disks, floppy disks, and removable disks; another magnetic medium, including tape; optical media, such as compact disks (CDs) or digital video disks (DVDs); or other types of storage devices. Note that the above instructions may be provided on one computer-readable or machine-readable storage medium, or may be provided on multiple computer-readable or machine-readable storage media distributed in a large system that may have multiple nodes. Such computer-readable or machine-readable storage media or media are considered part of an article (or article of manufacture). An article or article of manufacture may refer to any manufactured single component or multiple components. The storage medium or media may be located in the machine that runs the machine-readable instructions, or may be located at a remote site from which the machine-readable instructions may be downloaded over a network for execution.

[0079] In the present disclosure, the use of the terms "a", "an" or "the" is also intended to include the plural forms unless the context clearly indicates otherwise. In addition, the terms "includes", "including", "comprises", "comprising", "have" or "having", when used in the present disclosure, specify the presence of the elements described, but do not exclude the presence or addition of other elements.

[0080] In the foregoing description, many details are set forth to provide an understanding of the subject matter disclosed herein. However, implementations may be practiced without these details. Other implementations may include modifications and variations to the above details. The appended claims are intended to cover such modifications and variations.

Claims

1. A non-transitory machine-readable storage medium storing machine-readable instructions that, when executed, cause a system to: detecting a first alert associated with activity of a first group of entities, the first alert being generated by a security agent of a first type; predicting, based on the occurrence of the first alarm, a set of alarms including one or more alarms that are expected to occur, wherein a second alarm in the set of alarms is from a second type of security agent different from the first type of security agent; One or more remedial actions are generated to be applied in response to an alarm pattern, the alarm pattern comprising: the first alarm, and the one or more alarms in the alarm set; as well as In an electronic device to be protected from attack, information is provided of the one or more remedial actions to be applied by the electronic device in response to the occurrence of the alarm pattern.

2. The non-transitory machine-readable storage medium of claim 1, wherein a first remedial action of the one or more remedial actions is to be applied by a security agent of the second type in the electronic device to resolve the second alert.

3. The non-transitory machine-readable storage medium of claim 2, wherein a third alert in the set of alerts is from a third type of security agent that is different from each of the first type of security agent and the second type of security agent. 4 . The non-transitory machine-readable storage medium of claim 3 , wherein the third type of security agent in the electronic device is to apply a second remedial action in response to detecting the occurrence of the first alarm and the third alarm.

5. A non-transitory machine-readable storage medium according to claim 3, wherein the second type of security agent in the electronic device will apply the first remedial action in response to detecting a specific sequence of alarms occurring in the following order: the first alarm, the third alarm, and the second alarm.

6. A non-transitory machine-readable storage medium according to claim 5, wherein the second type of security agent in the electronic device will apply a second remedial action in response to detecting the first alarm and the second alarm but not detecting the third alarm, wherein the second remedial action is less aggressive than the first remedial action.

7. The non-transitory machine-readable storage medium of claim 2, wherein a third alert in the set of alerts is from a third type of security agent that is different from each of the first type of security agent and the second type of security agent, and wherein the instructions, when executed, cause the system to: providing, in a further electronic device to be protected from attack, information of said one or more remedial actions to be applied by said further electronic device in response to the occurrence of said alarm pattern, A second remedial action of the one or more remedial actions is to be applied by the third type of security agent in the additional electronic device to resolve the third alarm.

8. A non-transitory machine-readable storage medium according to claim 1, wherein a first security agent of one of the first type of security agent and the second type of security agent runs in the electronic device, and a second security agent of the other of the first type of security agent and the second type of security agent runs outside the electronic device.

9. The non-transitory machine-readable storage medium of claim 8, wherein the second security agent is part of a central security service.

10. The non-transitory machine-readable storage medium of claim 8, wherein the second security agent is part of another electronic device.

11. The non-transitory machine-readable storage medium of claim 1, wherein the predicting of the set of alarms including the one or more alarms that are expected to occur based on the occurrence of the first alarm is performed using a machine learning model.

12. The non-transitory machine-readable storage medium of claim 1, wherein the prediction of the set of alarms including the one or more alarms that are expected to occur based on the occurrence of the first alarm comprises: Signature-based prediction.

13. The non-transitory machine-readable storage medium of claim 1, wherein the instructions are executable in the electronic device.

14. The non-transitory machine-readable storage medium of claim 1, wherein the instructions are executable by a central security service separate from the electronic device.

15. A security system comprising: one or more processors; as well as A non-transitory storage medium storing instructions executable on the one or more processors to: detecting a first alert associated with activity of a first group of entities, the first alert being generated by a security agent of a first type; predicting, based on the occurrence of the first alarm, a set of alarms including one or more alarms that are expected to occur, wherein a second alarm in the set of alarms is from a second type of security agent different from the first type of security agent; generating a remedial action to be applied in response to an alarm pattern, the alarm pattern comprising: the first alarm, and the one or more alarms in the alarm set; as well as In an electronic device to be protected from attack, information of the remedial action is provided, which is to be applied by the electronic device in response to the occurrence of the alarm mode, wherein the information of the remedial action includes an entry, which associates the remedial action to the corresponding alarm in the alarm mode.

16. A security system according to claim 15, wherein the information of the remedial action specifies: a first remedial action to be applied in response to detecting a first subset of alarms in the alarm pattern that is less aggressive than a second subset of alarms in the alarm pattern, wherein the second subset of alarms includes more alarms than the first subset of alarms.

17. The security system of claim 15, wherein the prediction of the set of alarms including the one or more alarms that are expected to occur based on the occurrence of the first alarm is performed using a machine learning model.

18. The security system of claim 15, wherein the prediction of the set of alarms including the one or more alarms that are expected to occur based on the occurrence of the first alarm comprises: Signature-based prediction.

19. The security system of claim 15, wherein the electronic device is a first electronic device that includes the second type of security agent, and wherein the first type of security agent that generates the first alert is part of a second electronic device that is different from the first electronic device.

20. A method of a security system including a hardware processor, the method comprising: detecting a first alert associated with activity of a first group of entities, the first alert being generated by a security agent of a first type; predicting, based on the occurrence of the first alarm, a set of alarms including one or more alarms that are expected to occur, wherein a second alarm in the set of alarms is from a second type of security agent different from the first type of security agent; generating a remedial action to be applied in response to an alarm pattern, the alarm pattern comprising: the first alarm, and the one or more alarms in the alarm set; as well as Information about the remedial action is sent from the security system via a network to an electronic device to be protected from attack, and the remedial action will be applied by the electronic device in response to the occurrence of the alarm mode, wherein the information about the remedial action includes an entry that associates the remedial action to a corresponding alarm in the alarm mode.

Images