Network alarm enrichment

Abstract

A method includes collecting reports (56) of events from a plurality of computers (30) during a time period, each event including a communication activity performed by a process (48) having a respective ID (50) and executing on one of the computers. Respective feature groups (90) including characteristics of the activity are generated from the report, and a model (24) is trained to identify an ID of one of the processes executing one or more of the events based on the characteristics of the one or more of the events. An alarm (26) indicating malicious activity and referencing one or more reports of additional communication events performed by a given computer is received from a network management device (28), and a model is applied to the one or more reports in order to identify a given ID of a given process that causes the alarm on the given computer.

Description

Invention Field

[0001] This invention relates generally to computer security, and in particular to the identification of processes that execute on a host computer and lead to malicious activity. Background of the Invention

[0002] Many computer and network systems employ multiple layers of security devices and software to detect and defend against the increasing number of security threats. At the most basic level, computers use antivirus software to prevent malware from running on them. At the network level, intrusion detection and prevention systems analyze and control network traffic to detect and prevent malware from spreading across the network.

[0003] The above description is presented as a general overview of related technologies in the field and should not be construed as an admission that any information contained herein constitutes prior art to this patent application. Invention Overview

[0004] According to an embodiment of the present invention, a method is provided, the method comprising: collecting reports of communication events from a security agent executing on a respective host computer during a time period, each communication event including a communication activity performed by a process having a corresponding process identifier (ID) and executing on one of the host computers; generating a set of features based on each collected report, the set of features including characteristics of the communication activity and a corresponding process ID; training a model by a processor to identify the process ID of one of the processes performing one or more events based on the features of one or more events; receiving an alert from a network management device after the time period, the alert indicating malicious activity and referencing one or more reports of additional communication events performed by a given host computer; applying the model to the one or more reports of additional communication events to identify a given process ID of a given process on a given host computer that is responsible for the alert; and initiating a protection action for at least a given process executing on the given host computer.

[0005] In one embodiment, the network management device includes a firewall.

[0006] In another embodiment, generating a given feature includes extracting the given feature from a given collected report.

[0007] In another embodiment, generating a given feature includes normalizing the extracted given feature.

[0008] In another embodiment, generating a given feature includes computing the given feature based on one or more of the extracted features.

[0009] In the first feature embodiment, the given feature includes a domain.

[0010] In the second feature embodiment, the given feature includes an Internet Protocol (IP) address.

[0011] In some embodiments, a given feature indicates whether the IP address includes an Autonomous System Number (ASN).

[0012] In the third feature embodiment, the given feature includes the JA3 fingerprint.

[0013] In the fourth feature embodiment, the given feature includes a JA3S fingerprint.

[0014] In the fifth feature embodiment, the given feature includes a Server Name Indication (SNI) hostname.

[0015] In the sixth feature embodiment, a given feature includes a given process identifier.

[0016] In the seventh feature embodiment, the given feature includes a logical port number.

[0017] In the eighth feature embodiment, the given feature includes a process ID.

[0018] In the ninth feature embodiment, the given feature includes one or more network protocols used in communication activities.

[0019] In another embodiment, the application model includes generating additional features based on one or more additional communication events, and applying the model to the additional features.

[0020] In another embodiment, the host computer includes a first host computer, and the given host computer includes an additional host computer that is different from any of the first host computers.

[0021] In another embodiment, initiating protection for a given process includes isolating the given process.

[0022] In another embodiment, initiating protection for a given process includes displaying the details of the given process on a display.

[0023] In another embodiment, receiving an alarm includes receiving a given report for a specific communication event.

[0024] According to an embodiment of the present invention, an apparatus is also provided, comprising: a memory configured to store a model; and a processor configured to: collect reports of communication events from a security agent executing on a respective host computer during a time period, each communication event including communication activity performed by a process having a corresponding process ID and executing on one of the host computers; generate a set of features based on each collected report, the set of features including characteristics of the communication activity and a corresponding process ID; train a model to identify the process ID of one of the processes performing one or more events based on the features of one or more events; receive an alert from a network management device after the time period, the alert indicating malicious activity and referencing one or more reports of additional communication events performed by a given host computer; apply the model to one or more reports of additional communication events to identify a given process ID of a given process on a given host computer that caused the alert; and initiate a protection action for at least a given process executing on the given host computer.

[0025] According to embodiments of the present invention, a computer software product for protecting a computing device including a processor and memory, and coupled to a storage device storing one or more files, the computer software product including a non-transitory computer-readable medium storing program instructions, which, when read by the computer, cause the computer to: collect reports of communication events from a security agent executing on a respective host computer during a time period, each communication event including a communication activity performed by a process having a corresponding process ID and executing on one of the host computers; generate a set of features based on each collected report, the set of features including characteristics of the communication activity and a corresponding process ID; train a model to identify the process ID of one of the processes performing one or more events based on the features of one or more events; after the time period, receive an alert from a network management device indicating malicious activity and referencing one or more reports of additional communication events performed by a given host computer; apply the model to the one or more reports of additional communication events to identify a given process ID of a given process on a given host computer that caused the alert; and initiate a protection action for at least a given process executing on the given host computer. Brief description of the attached diagram

[0026] This disclosure is described herein by way of example only with reference to the accompanying drawings, in which: Figure 1 This is a block diagram illustrating an example of a computing facility including a security server according to an embodiment of the present invention, the security server being able to execute a machine learning model configured to enrich alerts received from a network management device; Figure 2 This is a block diagram illustrating an example configuration of a security server according to an embodiment of the present invention; and Figure 3 This is a flowchart schematically illustrating a method for enriching detected alarms and performing protective actions in response to alarms according to an embodiment of the present invention. Detailed Implementation

[0027] Different networks can deploy different types of security systems for detecting malicious activity (e.g., transmissions) on the network. The first type of security system can be installed on a network management device that manages data traffic between endpoints on the network, while the second type of security system can be installed on a security agent that runs on the endpoint itself.

[0028] While Type I security systems typically require fewer resources to manage than Type II systems, they are generally limited to identifying endpoints that generate malicious data traffic. On the other hand, while Type II systems are generally more expensive and require more management, they can typically identify any process performing malicious activity on any endpoint.

[0029] Embodiments of the present invention provide methods and systems for implementing machine learning models on security servers, which can enrich alerts received from network management devices (e.g., firewalls) using information collected from security agents. In embodiments described below, the security server can enrich these alerts by identifying a given software process executing on a host computer and carrying out communication activity that has triggered the alert.

[0030] As described below, during a time period (e.g., a training period), reports of communication events are collected from a security agent running on a corresponding host computer. Each communication event includes a communication activity performed by a process with a corresponding process identifier (ID) running on one of the host computers. Based on the collected reports, a corresponding feature set is generated, including characteristics of the communication activity and the corresponding process ID. The generated features are used to train a model to identify the process ID of one of the processes performing one or more events based on the characteristics of one or more events.

[0031] Following this time period (e.g., during production), an alert is received from the network management device indicating malicious activity and referencing one or more reports of additional communication events performed by a given host computer. Upon receiving the alert, a model is applied to one or more reports of additional communication events to identify a given process ID of a given process on the given host computer that caused the alert. Finally, a protection action is initiated against at least a given process that is executing on the given host computer and has the given process ID.

[0032] System Description Figure 1 This is a block diagram illustrating an example of a computing facility 20 including a security server 22 according to an embodiment of the present invention, the security server 22 performing an alert enrichment model 24 configured to enrich alerts 26 generated by network management devices (such as firewall 28).

[0033] exist Figure 1 In the configuration shown, security server 22 can communicate with one or more host computers 30 and one or more resource servers 32 via a data network (such as a local area network (LAN) 34). In embodiments herein, alert 26 includes reports of suspicious malicious activity initiated by one or more host computers 30 and / or one or more resource servers 32.

[0034] In some embodiments, resource server 32 includes a corresponding domain 36 (i.e., can be referenced or accessed via the corresponding domain 36), and resource server includes a corresponding Internet Protocol (IP) address 38. For example, resource server can host one or more web-based applications and / or provide network services (such as database management systems) for computer 30.

[0035] LAN 34 is also coupled to a network management device (such as firewall 28) that controls and monitors traffic between LAN 34 and a public network (such as the Internet 40), and can generate one or more alerts 26 when malicious traffic is detected on LAN 34 and / or received from the Internet 40. An example of firewall 28 is the PA-3250 Next Generation Firewall manufactured by Palo Alto Networks, Inc., 3000 Tanny Road, Santa Clara, California, 95054, USA. TM .

[0036] In the embodiments described herein, resource server 32, domain 36, and IP address 38 can be distinguished by appending letters after the identifier numbers, such that the resource server includes local resource server 32A and remote resource server 32B, the domain includes domains 36A and 36B, and the IP address includes IP addresses 38A and 38B. Figure 1 In the configuration shown: Resource server 32A is coupled to LAN 34 and includes the corresponding domain 36A and IP address 38A.

[0037] Resource server 32B can be accessed by host computer 30 via Internet 40 and includes a corresponding domain 36B and IP address 38B.

[0038] Each given host computer 30 may include a host processor 42 and host memory 44. Each host computer 30 includes a unique host identifier (ID) 46 (i.e., can be referenced by a displacement identifier (ID) 46), such as an Internet Protocol (IP) address or a Media Access Control (MAC) address.

[0039] exist Figure 1 In the configuration shown, processor 42 executes a group of processes 48 from memory 44, each having a corresponding process identifier (ID) 50 (i.e., a group of processes 48 stored in memory 44). In some embodiments, process ID 50 includes a unique identifier or process name for the process 48. Examples of process ID 50 include, but are not limited to, the name of the operating system (e.g., Windows, manufactured by Microsoft Corporation of Redmond, USA). TM ) and the name of the software application (e.g., POWERSHELL, also produced by Microsoft). TM CMD TM WORD TM Outlook TM and Excel TM ).

[0040] Each given processor 42 can execute a corresponding instance of the terminal security agent 54 (which may also be referred to herein as terminal agent 54, security agent 54, or agent 54) from its corresponding memory 44. An example of a given terminal agent 54 is the Cortex Extended Detection and Response from Palo Alto Networks. TM (XDR) TM ).

[0041] In the embodiments described herein, the terminal agent 54 and the firewall 28 can transmit event reports 56, which can be distinguished by appending letters after the identification numbers, such that the event reports include event report 56A generated and transmitted by the terminal security agent 54 and event report 56B generated and transmitted by the firewall 28. Event report 56 provides information about communication activity on LAN 34 as follows: Each given terminal agent 54, executing on a given host computer 30, generates an event report 56A that provides information about communication activities performed by the given host computer. Since the terminal agent executes on the host computer, each given event report 56A regarding a given communication activity can reference the given process 48 (e.g., via the corresponding process ID 50 of the given process 48). Additionally, while the terminal agent 54 can generate event reports 56A that provide information about other types of activities (e.g., initiating or terminating the given process 48), embodiments of the invention may be limited to event reports 56A that provide information about communication activities.

[0042] Firewall 28 executes network device logic 58, which analyzes communication activity including data traffic to / from host computer 30 and resource server 32A, and generates event report 56B in response to the communication activity. For example, a given event report 56 (i.e., 56A or 56B) may include a given host computer 30 transmitting a specific number of bytes to a given remote server 32B.

[0043] In embodiments of the invention, event report 56 typically refers to communication activities, which generally include communication between host computer 30 (or any computing device behind firewall 28) and remote resource server 32B (or any computing device outside the firewall). Therefore, a given event report 56 may refer to a given host computer 30 transmitting data to or receiving data from a given remote resource server 32B.

[0044] Although Figure 1 The configuration shown illustrates firewall 28 executing network device logic 58, but configurations in which network device logic is executed on any other device, such as a given host computer 30 or a given server 32A, are considered to be within the spirit and scope of the invention.

[0045] In some embodiments, a given host computer 30 may include a display 62, and a processor 42 may render a rendering 64 on the display that includes alarm context information, as described below.

[0046] Figure 2 This is a block diagram illustrating the hardware and software components of a security server 22 according to an embodiment of the present invention. Figure 2 In the configuration shown, the security server 22 includes a security processor 70 and a security memory 72. The security memory 72 includes an alarm enrichment model 24, a set of captured event reports 74, and a set of application families 76.

[0047] Each given captured event report 74 corresponds to a given event report 56 and may include activity (i.e., event) information, such as: Event categories 78 can be used to classify activities performed by a given process 48 executing on a given host computer 30. Examples of event categories 78 include, but are not limited to, communication activities (e.g., transferring data), file activities (e.g., accessing files), and process activities (e.g., initiating the execution of a given process 48).

[0048] Operation 80 indicates the details of the activity. Examples of operation 80 include file upload or Hypertext Transfer Protocol (HTTP) requests.

[0049] The date and time of the event: 82.

[0050] Host ID 84, which includes (i.e., stores) a given host ID 46 that references the given host computer 30 performing the action.

[0051] Process ID 86, which refers to a given process 48 that performs an action when executed on a given host computer. In the embodiments described herein, processor 70 may (typically only) extract process ID 86 from event report 56A.

[0052] User agent 88, which includes things like the operating system ID (e.g., Windows ID). TM This refers to the execution on a given host computer 30 with a given process ID 86 of a software application (not shown) that generates a given captured event report and executes the operations in the given captured event report on a given host computer. For example, the given process ID could refer to a web browser, such as Chrome (manufactured by Alphabet Inc., 1600 Amphitheatre Park Road, Mountain View, California, 94043, USA). TM .

[0053] A set of features 90, which includes characteristics of the action. Features 90 include extracted features 92 that the processor 70 can extract from a given event report and computed features 94, which include statistical values ​​that the server processor can compute based on the extracted features.

[0054] Examples of extractable features 92 that processor 70 can extract from a given event report 56 for a given communication session managed by a given process 48 include, but are not limited to: The given domain 36 accessed in a given communication session. In some embodiments, the processor 70 can normalize the given domain by identifying the root domain of the given domain and use the normalized root domain as a given feature 90.

[0055] The given IP address 38 is accessed in a given communication session.

[0056] An indication of whether a given IP address includes an Autonomous System Number (ASN).

[0057] The JA3 fingerprint includes a fingerprint of the Secure Sockets Layer (SSL) / Transport Layer Security (TLS) negotiation between a given host computer 30 (i.e., the client) and a given server 32. In some embodiments, the processor 70 may normalize the given JA3 fingerprint and use the normalized JA3 fingerprint as a given feature 90.

[0058] A JA3S fingerprint includes a server-side fingerprint negotiated between a given host computer 30 (i.e., the client) and a given server 32 during a response from a given server. In some embodiments, the processor 70 may normalize the given JA3S fingerprint and use the normalized JA3S fingerprint as a given feature 90.

[0059] The Server Name Indication (SNI) indicates the hostname that a given communication session attempts to connect to at the start of the handshake process (i.e., referring to a given host computer 30 or a given server).

[0060] A given process ID 86 refers to a software application (e.g., WORD or EXCEL) whose process ID is referenced by a given process executing a given communication session. In one embodiment, process ID 86 is provided by a given event report 56A. In another embodiment, process ID 86 may be calculated (i.e., “predicted”) by model 24 using the embodiments described herein.

[0061] A sequence of one or more network protocols used in a given communication session. In some embodiments, each of the network protocols may have a specific purpose (i.e., for a specific service), such as web browsing. Examples of these network protocols are described below.

[0062] The logical communication port number accessed in a given communication session.

[0063] The duration of a given communication session.

[0064] The amount of data transmitted and / or received in a given communication session.

[0065] Examples of the calculated feature 94 include, but are not limited to: How many terminal agents reported a count of a given communication session accessing a given domain 36.

[0066] How many terminal agents reported a count of a given communication session accessing a given IP address 38.

[0067] How many terminal agents reported a count of a given communication session that included a given JA3 fingerprint.

[0068] In some embodiments, a given process ID 86 can refer to an application belonging to a single application family (e.g., Microsoft Office). TM And therefore, when executed on a given processor 42, the software application exhibits similar characteristics. In these embodiments, each application family 76 may include a family ID 98 and multiple process IDs 98 referencing the software application within the family. For example, a given process ID 98 may reference WORD in its corresponding process ID 98. TM Outlook TM and Excel TM Office TM Sharing between applications. In one family of embodiments, processor 70 can detect the shared public path of the identified applications. \ Program Files\Microsoft Office The processor 70 identifies the application referenced by process ID 98 by detecting any identical domains or IP addresses accessed by the application. In another family of embodiments, the processor 70 can identify the application referenced by process ID 98 by detecting any identical domains or IP addresses accessed by the application.

[0069] Processors 42 and 70 include general-purpose central processing units (CPUs) or dedicated embedded processors, programmed in software or firmware to perform the functions described herein. This software can be downloaded electronically to, for example, a network to secure server 22 and host computer 30. Alternatively or additionally, the software can be stored on a tangible, non-transitory computer-readable medium, such as optical, magnetic, or electronic storage media. Again, alternatively or additionally, at least some of the functions of processors 42 and 70 can be executed by hardwired or programmable digital logic circuitry.

[0070] Examples of memories 44 and 72 include dynamic random access memory, non-volatile random access memory, hard disk drives, and solid-state drives.

[0071] In some embodiments, the tasks described herein, performed by processors 42, 70 and network device logic 58, can be partitioned across multiple physical and / or virtual computing devices. In other embodiments, these tasks can be performed within a managed cloud service.

[0072] Network management device alarm enrichment Figure 3 This is a flowchart illustrating, schematically, a method for selecting and performing a protective action in response to detecting a given alarm 26 according to an embodiment of the present invention.

[0073] In step 100, processor 70 collects event reports 56B from terminal agent 54 during a time period (i.e., the training period). As described above, each report 56B references a communication event including a communication activity performed by a given process 48 having one of process IDs 50.

[0074] In step 102, processor 70 generates feature 90 by extracting feature 92 from the collected events and the collected process IDs and calculating feature 94 based on the extracted feature 92. The following is an example of information that can be stored in two different captured event reports (i.e., regarding two different communication events).

[0075] In the first example, that is, regarding the first given communication session: Clan ID 96: system 92. Referencing the first given feature of a network protocol in a communication session: IP, TCP, SSH Process ID 86: ssh The second given characteristic 92 refers to the accessed logical communication port number in the communication session: 53 User agent 88's operating system ID: WINDOWS TM Domain 36: notsafe.com IP address 38: 1.2.3.4 Operation 80: Uncommon network tunnel creation User Agent 88: Mozilla / 5.0 (Windows NT 10.0; Win64; x64) AppleWebKit / 537.36 (KHTML, like Gecko) Evernote / 10.51.7 Chrome / 102.0.5005.167 Electron / 19.1.8 Safari / 537.36 Referencing the third given feature 92 of SNI in a communication session: notsafe.com Referencing the third given feature 92 of the JA3 fingerprint in the communication session: b32309a26951912be7dba37639 8abc3b The fourth given feature of the JA3S fingerprint is referenced in the communication session: 92. 6da3d3d0a98c7d4d4822c1f24 29a720b.

[0076] In the second example, that is, regarding the second given communication session: Clan ID 96: browser 92. Referencing the first given feature of a network protocol in a communication session: IP, TCP, BoxNet-Base Process ID 86: CHROME TM The second given characteristic 92 refers to the accessed logical communication port number in the communication session: 443 User agent 88's operating system ID: WINDOWS TM Domain 36: app.box.com IP address 38:5 .6.7.8 Operation 80: A user accessed an uncommon external file-sharing service User Agent 88: Microsoft-CryptoAPI / 10.0 Referencing the third given feature 92 of SNI in a communication session: app.box.com Referencing the third given feature 92 of the JA3 fingerprint in the communication session: 9c29c3d400525d0f8afd693d67 295de7 The fourth given feature 92 of the JA3S fingerprint is referenced in the communication session: 16c0b3e6a7b8173c16d944cfe aeee9cf .

[0077] In step 104, processor 70 trains model 24 using process ID 86 and feature 90. In embodiments herein, model 24 includes a machine learning model that can identify a given process ID 50 of a given process 48 performing a given communication event corresponding to a given event report 56 based on feature 90 generated for a given event report 56.

[0078] In some embodiments, processor 70 may also use other information stored in the captured event report (e.g., event category 78, operation 80, date and time 82, host ID 84, user agent 88) to train model 24. In these embodiments, all information stored in the captured event report may be collectively referred to as feature 90.

[0079] In step 106, at a time following a period of time (e.g., during production after a training period), processor 70 receives a new alert 26 from network device logic 58, which indicates malicious activity performed by a given host computer 30 and references one or more event reports 56B. In one embodiment, a given terminal agent 54 can analyze communication events in communication event reports 56A generated by the given terminal agent, detect suspicious malicious activity in one or more communication events (i.e., a single communication event or a sequence of multiple communication events), and generate an alert for the detected suspicious malicious activity. Similarly, firewall 28 can analyze communication events in communication event reports 56A generated by the firewall, detect suspicious malicious activity in one or more communication events, and generate an alert for the detected suspicious malicious activity.

[0080] Upon receiving a new alarm, processor 70 collects referenced event reports 56B (which references corresponding communication events of communication activities performed by a given host computer) and generates additional features 90 based on one or more of the referenced event reports 56B.

[0081] In step 108, processor 70 applies model 24 to one or more referenced event reports (including additional features generated based on one or more referenced event reports) to identify the process IDs of one or more processes 48 on a given host computer that perform the communication activities referenced by one or more event reports 56B and thus cause the received alarms. The use of model 24 to identify one or more processes is described below.

[0082] Finally, in step 110, processor 70 initiates a protection action against at least one or more identified processes, and the method terminates. In one protection action embodiment, processor 70 may initiate a protection action by performing an isolation action (e.g., termination, isolation, or removal) on one or more identified processes or on the host computer executing one or more identified processes. To identify a given process, model 24 may identify a given process ID 50, and processor 70 may send a request to the given host computer to perform a protection action on any process 48 executing on the given host computer whose corresponding process ID 50 matches the given process ID 50 (i.e., the output of model 24).

[0083] In another embodiment of the protection action, processor 70 can initiate a protection action by presenting details (e.g., process IDs) of one or more identified processes to a Security Operations Center (SOC) analyst (not shown) in a rendering 64 on display 62. In this embodiment, rendering 64 provides the SOC analyst with context about the received alerts, enabling the SOC analyst to formulate an effective response.

[0084] While the embodiments described above describe the identification of a given process 48 on a given host computer 30, using these embodiments to identify processes 48 on other computing devices is considered to be in accordance with the spirit and scope of the invention. In one example, processor 70 may use the embodiments described herein to identify a given process 48 executing on a given server 32A. In another example, model 24 may be deployed on different security servers 22 that use the embodiments described above to protect computing devices (e.g., host computers and / or server computers) in different computing facilities.

[0085] In some embodiments, identifying one or more processes (i.e., as described with reference to step 108 above) may include identifying a chain of processes 48 that terminates a given process 48 that causes an alarm. For example, the chain may include a first process 48 that references a process spawning a second process 48. EXPLORER.EXE The second process 48 references the incubation of the third process 48. FIREFOX.EXE The third process 48 referenced and executed communication activities that triggered the given alarm 26. FIREFOXUPDATER.EXE In these embodiments, processor 70 may perform protection actions on one or more processes in the chain (e.g., a third process, a second and third process, or a first, second and third process).

[0086] Additionally, in these embodiments, while the event category of the process that triggers a given alarm 26 typically indicates communication activity, the event category of a given parent process in the chain (e.g., EXPLORER.EXE and FIREFOX.EX E) May not indicate communication activity.

[0087] In another embodiment, processor 70 may compare a given identified process ID 50 (i.e., in step 108) with process ID 98 in application family 76. In these embodiments, processor 70 may compare the process ID identified by model 24 with process ID 98 and detect a match between the process ID identified by the model and a given process ID 9 in the given application family 76. Then, processor 70 may perform the aforementioned arbitrary protection action on any process 48 executing on the given host computer whose corresponding process ID 86 matches any process ID 98 in the given application family.

[0088] Furthermore, while the embodiments described above describe enriching alarm 26, using these embodiments to enrich event reports 56 is considered to be within the spirit and scope of the invention.

[0089] In another embodiment, processor 42 may use the embodiments described above (i.e., in the description referring to steps 106-108) to enrich a specific event report 56B. In other words, processor 42 may perform in response to a specific event report 56B even if the processor has not received a given alarm 26 referencing a specific event report. In these embodiments, upon receiving a specific report, processor 42 may: Additional feature 90 is generated based on specific event report 56B.

[0090] Model 70 is applied to specific event reports and the generated features to identify one or more process IDs 50 of one or more processes 48 that perform the communication activity referenced in the specific event report on a given host computer 30 and thus result in the communication activity in the specific event report.

[0091] Initiate protection actions against at least one or more identified processes.

[0092] For example, processor 42 can use these additional embodiments to mark any communication activity going to / from a specific domain and / or IP address.

[0093] It should be understood that the above embodiments are cited by way of example, and the invention is not limited to what has been specifically shown and described above. More precisely, the scope of the invention includes combinations and sub-combinations of the various features described above, as well as variations and modifications of these features that would occur to those skilled in the art after reading the foregoing description and that are not disclosed in the prior art.

Claims

1. A method comprising: During a certain period of time, reports of communication events are collected from a security agent running on the respective host computer. Each communication event includes a communication activity performed by a process having a corresponding process identifier ID and running on one of the host computers. Based on each collected report, a set of features is generated, which includes the characteristics of the communication activity and the corresponding process ID; The processor trains a model to identify the process ID of one of the processes executing one or more events in the event based on the characteristics of one or more events in the event; After the stated time period, an alert is received from the network management device, the alert indicating malicious activity and referencing one or more reports of additional communication events performed by a given host computer; The model is applied to one or more reports of the additional communication events in order to identify a given process ID of a given process that caused the alarm on a given host computer; as well as Initiate a protection action against at least the given process executing on the given host computer.

2. The method according to claim 1, wherein, The network management device includes a firewall.

3. The method according to claim 1, wherein, Generating a given feature involves extracting the given feature from a given collection of reports.

4. The method according to claim 3, wherein, The generation of given features includes the normalized extraction of given features.

5. The method according to claim 3, wherein, Generating a given feature involves calculating the given feature based on one or more of the extracted features.

6. The method according to claim 3, wherein, The given features include domains.

7. The method according to claim 3, wherein, The given characteristics include Internet Protocol (IP) addresses.

8. The method according to claim 7, wherein, The given characteristic indicates whether the IP address includes an Autonomous System Number (ASN).

9. The method according to claim 3, wherein, The given features include JA3 fingerprints.

10. The method according to claim 3, wherein, The given features include JA3S fingerprints.

11. The method according to claim 3, wherein, The given features include the Server Name Indicator (SNI) hostname.

12. The method according to claim 3, wherein, The given feature includes the given process identifier.

13. The method according to claim 3, wherein, The given characteristics include the logical port number.

14. The method according to claim 3, wherein, The given characteristics include the process ID.

15. The method according to claim 3, wherein, The given features include one or more network protocols used in the communication activity.

16. The method according to any one of claims 1 to 15, wherein, Applying the model includes generating additional features based on the one or more additional communication events, and applying the model to the additional features.

17. The method according to any one of claims 1 to 15, wherein, The host computer includes a first host computer, and wherein the given host computer includes an additional host computer that is different from any of the first host computers.

18. The method according to any one of claims 1 to 15, wherein, Initiating the protection for a given process includes isolating the given process.

19. The method according to any one of claims 1 to 15, wherein, Initiating protection for a given process includes displaying the details of the given process on a display screen.

20. The method according to any one of claims 1 to 15, wherein, Receiving the alarm includes receiving a given report for a specific communication event.

21. An apparatus comprising: - A memory configured as a storage model; and - A processor, which is configured to: --During a period of time, reports of communication events are collected from a security agent running on the corresponding host computer. Each communication event includes a communication activity performed by a process having a corresponding process ID and running on one of the host computers. --Based on each collected report, a set of features is generated, the set of features including the characteristics of the communication activity and the corresponding process ID; --Train a model to identify the process ID of one of the processes executing one or more events in the event based on the characteristics of one or more events in the event; --After the said time period, receive an alert from the network management device, the alert indicating malicious activity and referencing one or more reports of additional communication events performed by a given host computer; -- Apply the model to one or more reports of the additional communication events to identify a given process ID of a given process that caused the alarm on a given host computer; as well as --Initiate a protection action against at least the given process executing on the given host computer.

22. A computer software product for protecting a computing device, the computing device including a processor and memory, and coupled to a storage device storing a set of one or more files, the computer software product including a non-transitory computer-readable medium storing program instructions that, when read by a computer, cause the computer to: During a certain period of time, reports of communication events are collected from a security agent running on the respective host computer. Each communication event includes a communication activity performed by a process having a corresponding process ID and running on one of the host computers. Based on each collected report, a set of features is generated, which includes the characteristics of the communication activity and the corresponding process ID; The model is trained to identify the process ID of one of the processes that executes one or more events in the event, based on the characteristics of one or more events in the event; After the stated time period, an alert is received from the network management device, the alert indicating malicious activity and referencing one or more reports of additional communication events performed by a given host computer; The model is applied to one or more reports of the additional communication events in order to identify a given process ID of a given process that caused the alarm on a given host computer; as well as, Initiate a protection action against at least the given process executing on the given host computer.

Images