Method of threat detection in threat detection network, node of threat detection network, threat detection network, computer program, and computer-readable medium

Abstract

To provide a reliable and efficient threat detection method and threat detection network.SOLUTION: A threat detection network includes interconnected nodes 5a-5h and a backend system 2. The backend system utilizes a backend threat detection mechanism, and at least part of the nodes comprise security agent modules 6a-6h which collect data related to the respective node. The nodes utilize at least one local threat detection model which comprises a machine learning-based model of the backend threat detection mechanism. A threat detection method in the threat detection network comprises: collecting data related to the node by the security agent module at the node; applying the local threat detection model to the collected data; and making a security related decision at the node, such as an endpoint, based on results of the local threat detection model.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a method for detecting threats in a threat detection network, a node of the threat detection network, a back-end server of the threat detection network, and the threat detection network. [Background technology]

[0002] Security systems for computers and computer networks are used to detect threats and anomalies in computers and networks. Such examples are endpoint detection and response (EDR) and managed detection and response (MDR) products and services. EDR focuses on detecting and monitoring breaches as they occur and helps determine how to best respond to detected breaches. The growth of efficient and robust EDR solutions has been made possible in part by the advent of machine learning, big data, and cloud computing. MDR is a managed cybersecurity service for threat detection, response, and remediation.

[0003] Modern EDR and MDR services rely on lightweight endpoint-side software agents or sensors that collect, pre-process, and submit relevant status and behavioral data to the backend, where the data processing pipeline focuses on advanced enrichment and analysis of the data for further timely attack detection and response. The increasing complexity and sophistication of advanced cyber attacks requires continuous development and maintenance of mechanisms from EDR and MDR service providers to enable early detection of new and modified attack patterns. To this end, two opposing families of approaches exist: misuse detection and anomaly detection.

[0004] Misuse detection is efficient in that it makes qualitative decisions with a very low false positive rate. In a back-end setting, misuse detection explicitly enforces a data-driven process in the cybersecurity enterprise, bringing additional benefits: full control over detection and response processes and tools, fast and reliable updates of attack detection routines, flexibility in exploring and experimenting with available data. However, the drawbacks of back-end misuse detection are: limited private data processing, increased vulnerability window due to the unavoidable time overhead required to pass data to the back-end data processing pipeline, low coverage for detecting unknown attack patterns due to high accuracy, and difficulty in creating and maintaining a local back-end context for endpoint entities such as processes, applications, and users.

[0005] Anomaly detection mechanisms in general, and their back-end implementations in particular, facilitate adjacent EDR- and MDR-centric processes, including threat intelligence and threat hunting. In the area of ​​attack detection, they are prone to false positives and usually perform suboptimally by helping to spot novelty, outliers, and anomalies in submitted data. The main benefit they bring is their ability to highlight unexpected and odd states and behaviors of key endpoint-entities (processes, applications, user accounts, etc.). This property comes into play when the condition clauses that trigger the detection logic are too precise or too limited to recognize new attacks not seen before due to lack of misuse detection knowledge. Summary of the Invention [Problem to be solved by the invention]

[0006] However, the problem with MDR and EDR is that the amount of data generated by data collectors can be quite large. The amount of data is usually proportional to the activity occurring at a given MDR and EDR endpoint, so if the activity at that MDR and EDR endpoint is large, the amount of data generated is also large. The direct consequences of such a large amount of data include a decrease in the quality of service, an increase in the cost of service, and an increase in the consumption of resources associated with managing large amounts of data. For example, when a large amount of data needs to be processed and made available in a usable format, the associated resource overhead and monetary costs can be very large in some cases for the MDR and / or EDR provider, which can result in an increase in the cost of providing MDR or EDR to customer organizations. Therefore, many enterprises do not deploy EDR and continue to rely solely on End Point Protection (EPP) solutions, which poses security risks as basic EPP services cannot provide sufficient defense against advanced fileless threats.

[0007] For these reasons, there is a need for a reliable and efficient threat detection method and network. [Means for solving the problem]

[0008] The following presents a simplified summary in order to provide a basic understanding of some aspects of various invention embodiments. This summary is not an extensive overview of the invention. It is not intended to identify key or critical elements of the invention or to delineate the scope of the invention. The following summary merely presents some concepts of the invention in a simplified form as a prelude to a more detailed description of example embodiments of the invention.

[0009] According to a first aspect, the present invention relates to a method, e.g., a computer-implemented method, of threat detection in a threat detection network, the threat detection network including interconnected nodes and a back-end system, the back-end system utilizing a back-end threat detection mechanism. At least a portion of the nodes, e.g., network nodes, include a security agent module that collects data related to each of the nodes. The nodes utilize at least one local threat detection model that includes a machine learning based model of a back-end threat detection mechanism. The threat detection method includes collecting data related to the nodes by the security agent module at the nodes, applying the local threat detection model to the collected data, and making security-related decisions at the nodes, e.g., endpoints, based on results of the local threat detection model.

[0010] In one aspect of the invention, the local threat detection model, which includes a machine learning based model of the backend threat detection mechanism, is an approximation of the backend rule-based threat detection mechanism.

[0011] In one aspect of the invention, the local threat detection model includes at least one misuse detection model based on at least one machine learning model for discovering events that are likely to contribute to the detection of a cyber incident.

[0012] In one aspect of the invention, the misuse detection model is trained in the backend system in a supervised learning manner for a classification problem.

[0013] In one embodiment of the invention, the training set of the misuse detection model comprises a complementary subset of existing events that have been proven to be associated with existing confirmed cyber incidents and / or cyber attacks and / or represent typically benign behavior.

[0014] In one embodiment of the invention, the local threat detection model further includes at least one anomaly detection model based on at least one machine learning model for discovering uncommon events likely to contribute to threat detection, intelligence, and / or hunting objectives.

[0015] In one aspect of the invention, at least one of the anomaly detection models is trained in the backend system or in the node in an unsupervised, supervised, or semi-supervised learning manner.

[0016] In one aspect of the invention, training of the misuse detection and / or anomaly detection models is performed periodically and / or once the training process is finished, new models are sent to the node and used locally by said node.

[0017] In one aspect of the invention, the agent at the node uses the local threat detection model to obtain a score for a stream of observed local events in a timely manner and / or to arrange the observed events on a timeline in order of occurrence and combine the scores assigned to the timeline by the local threat detection model.

[0018] In one aspect of the invention, the anomaly detection model and / or misuse detection model is applied to the events observed on each node and overlaid on a timeline graph as a set of respective time series.

[0019] In one embodiment of the invention, every new event gets a score or set of scores from the anomaly detection model and / or misuse detection model.

[0020] In one aspect of the invention, the node utilizes both an anomaly detection model and a misuse detection model at the node and uses the models together by looking at the relationship between the score patterns between the anomaly detection model and the misuse detection model.

[0021] In one aspect of the invention, preparing the machine learning based threat detection model includes defining backend threat detection mechanism features, defining local threat detection model features, and training the local threat detection model based on training data and / or the backend threat detection mechanism.

[0022] According to a second aspect, the invention relates to a node of a threat detection network, e.g., a network node, comprising interconnected nodes and a back-end system, the nodes comprising at least one or more processors and at least one security agent module configured to collect data related to each of the nodes, the nodes further configured to utilize a local threat detection model comprising a machine learning based model of a back-end threat detection mechanism, the nodes collect data related to the nodes by the security agent module at the nodes, apply the local threat detection model to the collected data, and make security-related decisions at the nodes, e.g., endpoints, based on the results of the local threat detection model.

[0023] In one aspect of the invention, the node is configured to perform the threat detection method of any of the aspects of the invention.

[0024] According to a third aspect, the present invention relates to a threat detection network including at least one node of any of the aspects of the present invention and at least one backend system, said backend system (2) including at least one server including at least one or more processors, said backend system configured to utilize a backend threat detection mechanism and further configured to train and / or provide to the node local threat detection models including anomaly detection models and / or misuse detection models.

[0025] According to a fourth aspect, the invention relates to a computer program comprising instructions which, when executed by a computer, cause said computer to carry out the threat detection method of the invention.

[0026] According to a fifth aspect, the present invention relates to a computer readable medium comprising a computer program according to the present invention. Effect of the Invention

[0027] The inventive solution allows for a reliable and efficient threat detection method and threat detection network. The inventive solution also allows for an optimal trade-off between high accuracy of the misuse detection mechanism and high sensitivity of the anomaly detection mechanism. The inventive solution also allows for a reduction in the amount of data generated by the data collectors that are sent to the backend. [Brief description of the drawings]

[0028] [Figure 1] 1 illustrates a schematic diagram of an exemplary network architecture of an embodiment of the present invention; [Diagram 2] An exemplary embodiment of the inventive solution is presented, which comprises two local computer networks and a security service network. [Figure 3A] Illustrative embodiments of different scenarios according to embodiments of the present invention are presented. [Figure 3B] Illustrative embodiments of different scenarios according to embodiments of the present invention are presented. [Figure 3C] Illustrative embodiments of different scenarios according to embodiments of the present invention are presented. [Figure 4] 1 illustrates an exemplary method according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0029] Embodiments of the present invention are illustrated by way of example, and not by way of limitation, in the accompanying figures.

[0030] Various illustrative and non-limiting embodiments of the present invention, both as to structure and method of operation, together with additional objects and advantages thereof, will be best understood from the following description of specific illustrative and non-limiting embodiments when read in connection with the accompanying drawings.

[0031] Verbs such as "comprise" and "comprise" are used in this specification as open limitations which do not require the exclusion of the presence of any unrecited features. Features recited in the dependent claims may be freely combined with one another, unless expressly stated otherwise.

[0032] Furthermore, it will be understood that throughout this specification the use of the singular forms "a", "an", etc. does not exclude a plural.

[0033] A threat detection network according to an embodiment of the invention may include at least one node, such as a network node, and at least one back-end server. In this case, information, such as threat detection models, may be shared between the nodes and / or between the nodes and the back-end server. In an embodiment of the invention, a threat detection network may include only multiple nodes, and no back-end server is required. In this case, information, such as threat detection models, may be shared between the nodes.

[0034] Fig. 1 shows a schematic diagram of an exemplary network architecture of an embodiment of the present invention, in which the inventive solution can be used. In Fig. 1, a part of a first computer network 1 is shown diagrammatically, in which a computer system, for example an EDR system, is installed. Also, any other computer system capable of implementing an embodiment of the present invention can be used instead of or in addition to the EDR system used in this example. The first computer network is connected to a security service network, here a security backend / server 2, via a cloud 3. The backend / server 2 forms a node on the security service computer network with respect to the first computer network. The security service computer network can be managed by an EDR system provider and can be separated from the cloud 3 by a gateway or other interface (not shown) or other network element suitable for the backend 2. The first computer network 1 may also be separated from the cloud 3 by a gateway 4 or other interface. Other network structures are possible.

[0035] The first computer network 1 is formed from a number of interconnected nodes 5a-5h, each of which represents an element in the computer network 1, such as a computer, smartphone, tablet, laptop, or other network-enabled hardware. Each node 5a-5h shown in the computer network also represents an EDR endpoint on which a security agent module 6a-6h, which may include a data collector or "sensor," is installed. The security agent module may also be installed on any other element of the computer network, such as a gateway or other interface. In the example of FIG. 1, the security agent module 4a is installed on the gateway 4. The security agent modules 6a-6h, 4a collect various types of data at the nodes 5a-5h or the gateway 4, including, for example, program or file hashes, files stored on the nodes 5a-5h, logs of network traffic, process logs, binaries or files excised from memory (e.g., DLL, EXE, or memory forensic artifacts), and / or logs (e.g., TCP dumps) from monitoring actions performed by programs or scripts executed on the nodes 5a-5h or the gateway 4.

[0036] The collected data may be stored in a database or similar model for information storage for further use. Any kind of threat model may be further constructed by the security application in the backend / server 2 and / or in the second server, in the nodes 5a-5h, and stored in a database. The nodes 5a-5h and the server 2 typically comprise a hard drive, a processor, and a RAM.

[0037] Any type of data that can assist in the detection and monitoring of security threats, such as security breaches or intrusions into the system, can be collected by the security agent modules 6a-6h, 4a during their lifecycle, and the type of data observed and collected can be set according to rules defined by the EDR system provider at the time of installation of the EDR system and / or when delivering components of the threat detection model and / or behavior model. In one embodiment of the present invention, at least some of the security agent modules 6a-6h can also have the ability to make decisions regarding the type of data observed and collected by themselves. For example, the security agents 6a-6h, 4a can collect data regarding the behavior of programs running on the EDR endpoint and can observe when new programs are started. If appropriate resources are available, the collected data can be stored by the security agent modules 6a-6h, 4a permanently or temporarily in a suitable storage location (not shown) on their respective nodes, or on the first computer network 1.

[0038] The security agent modules 6a-6h, 4a are configured to transmit information, such as collected or transmitted data, to and from the EDR backend 2 via the cloud 3. This allows the EDR system provider to remotely manage the EDR system without having to maintain a constant human presence at the organization managing the first computer network 1.

[0039] In one embodiment of the present invention, the security agent modules 6a-6h, 4a may also be configured to establish an internal network, e.g., an internal swarm intelligence network, including security agent modules of multiple interconnected nodes 5a-5h of the local computer network 1. The security agent modules 6a-6h, 4a are further configured to share information based on the collected data within the established internal network, as each security agent module 6a-6h, 4a collects data regarding the respective nodes 5a-5h. In one embodiment, the swarm intelligence network is composed of multiple semi-independent security nodes (security agent modules) that can function as well on their own. Thus, the number of instances in the swarm intelligence network may vary considerably. Also, there may be two or more connected swarm intelligence networks working together within one local computer network.

[0040] The security agent modules 6a-6h, 4a are further configured to use the collected data and information received from the internal network to generate and adapt models related to the respective nodes 5a-5h and / or their users. The models may be, for example, user behavior models, threat detection models, etc.

[0041] Figure 2 illustrates a high-level concept of an embodiment of the present invention. The example of Figure 2 illustrates two local computer networks 1A, 1B and a security service network 2, each of which further comprises a local center node 7, 8, a plurality of interconnected nodes, and a security agent module in each of the plurality of nodes. The security agent module can be configured to establish an internal swarm intelligence network within each local computer network. The behavioral model created in the solution of the present invention can be shared between the computer networks, the local center node, the nodes, and the back-end system.

[0042] In an exemplary normal operation mode, the agent deployment structure may consist of, on average, one agent residing on one node, such as an endpoint, local communication node, and information aggregation center (local center nodes 7, 8). In one embodiment, security agents may be constructed such that at least some of their functions, if any, are inactive, thereby also allowing the cloning of new agents into roles different from those held by the original host.

[0043] In one embodiment, a security agent module can activate one or more components of its modular architecture and replicate itself. Additionally, if any of the security agent modules detects a need for additional resources to manage a detected security threat or for analysis of a suspected security threat, the security agent module can request resources from other security agent modules or even spawn a new virtual security agent module in one embodiment of the present invention.

[0044] In one embodiment, sandboxing techniques may be used by the security agent module to determine a remedy for a detected security threat and / or to further analyze the behavior of a potentially malicious entity. Sandboxing may be utilized to execute suspicious code or actions in an environment where the results can be observed to establish the validity of the threat.

[0045] In one embodiment, suspicious events among the monitored events may be detected by one or more detection mechanisms used, in one embodiment, the detection mechanisms used to detect suspicious events may include using at least one of machine learning models, scanning engines, heuristic rules, statistical anomaly detection, fuzzy logic based models, and any predefined rules.

[0046] In a solution of the present invention, a node utilizes at least one local threat detection model that includes a machine learning based model of a back-end threat detection mechanism. The method includes collecting data related to the node by a security agent module at the node, applying the local threat detection model to the collected data, and making security-related decisions at the node, such as an endpoint, based on results of the local threat detection model.

[0047] In one embodiment, the method may include training the machine learning model used for threat detection by utilizing one or more of the following approaches used to train the machine learning model: distributed learning by combining local and global information with model parts, reinforcement learning by getting feedback on successful final results, meta-learning by utilizing external information in the learning process, and / or sharing information to bootstrap models and adjusting learning behavior.

[0048] In one embodiment of the present invention, a node such as an endpoint may utilize both anomaly detection models and threat detection models. In one embodiment, machine learning based misuse and anomaly detection mechanisms may be combined in a node such as an endpoint. The detection mechanisms in a node, e.g., an endpoint, process events that represent activities of key operational entities such as computer processes, applications, and users. An event may describe a single activity performed by a single subject (i.e., that actor) with a single object (e.g., a file system, a network, configuration storage, another operational entity such as a process, etc.). Thus, each event may have a timestamp that refers to its occurrence or its observation time. In one embodiment of the present invention, it is not necessary for the local threat detection model to include a machine learning based model of the backend threat detection mechanism. In this case, all embodiments in this application may be executed without a local threat detection model with a machine learning based model of the backend threat detection mechanism, but the local threat detection model may include, for example, other machine learning models.

[0049] The node-side detection mechanisms can operate with events such that every new event gets a score or set of scores from every mechanism. The semantics of the scores can be defined by the purpose of the mechanism. For simplicity in these examples, a high score value can be considered to represent the potentially high value of the respective event for threat detection, intelligence, and hunting purposes.

[0050] The misuse detection mechanism used in the solution of the present invention can be based on a machine learning model focused on finding events that are likely to contribute to the detection of cyber incidents, e.g., existing cyber attacks and their implementation. The model can be trained, for example, in a supervised learning manner for a binary classification problem in a back-end system. The training set can consist of complementary subsets (e.g., two) of existing events, each of which has been proven to be related to a confirmed cyber incident and represents a typical benign behavior. The training of the model can be regular to address concept drift in the data, and once the training process is finished, the new model can be sent to the agents or sensors in the node and used locally by them.

[0051] The anomaly detection mechanism used in the solution of the present invention can be based on machine learning models that focus on discovering non-common events that are likely to contribute to threat detection, intelligence, and hunting purposes. The models can be trained in an unsupervised learning manner both on the back-end side and on the nodes, e.g., at the endpoints. If the training process is located on the back-end side, the new models can be sent to the agents or sensors of the nodes and used locally by them.

[0052] Nodes, such as endpoint devices with installed agent or sensor software, can use the model to obtain scores for a stream of observed local events in a timely manner, e.g., one by one. By arranging the events on a timeline in the order of their occurrence and combining their scores assigned by the model, a set of time series can be obtained that represents the misuse and anomaly detection mechanism's real-time local (i.e., endpoint-side) view of ongoing activity. The obtained view (e.g., events observed on each asset overlaid on a timeline graph as a set of time series) provides a new data source for further endpoint-side inference focused on advanced real-time attack detection, threat hunting, and intelligence.

[0053] The challenge is to define and maintain the tradeoff between high accuracy (and therefore low sensitivity) of misuse detection mechanisms and high sensitivity (and therefore low accuracy) of anomaly detection mechanisms. In particular, early attack detection, threat intelligence, and threat hunting require a good balance of threat detection models used to operate.

[0054] Machine learning-based misuse detection models can work by generating a score that can be compared to a predefined threshold to highlight malicious events with a high level of confidence. This means that events with a score that is reasonably high but below the given threshold are not considered in the decision-making process. In this case, a significant portion of potentially interesting events is ignored. To address this issue, instead of looking at the individual scores of events, one can look at patterns of scores over a time window. Successive suspicious events (where the individual scores of the misuse detection are not high enough) may be detected as representing, for example, an unknown attack pattern or a "low and slow" attack.

[0055] In some exemplary embodiments, machine learning based anomaly detection models work in conjunction with misuse models, and FIGS. 3A-3C provide some exemplary scenarios for these types of embodiments.

[0056] In the scenario of Figure 3A, a potential attack reported by the misuse detection mechanism can be confirmed by an anomaly-based attack detection mechanism. For example, consecutive bursts of elevated scores may be reported by the misuse model that are below but not far from a given threshold level. The presence of well-aligned bursts of elevated scores reported by the anomaly detection model can be used to confirm the presence of a sequence of atypical events that are highly likely to be relevant from an attack detection perspective.

[0057] In the scenario of Figure 3B, the most interesting time intervals within the time window of a potential attack reported by the misuse detection mechanism can be highlighted for further consideration. For example, consecutive bursts of high scores reported by the misuse detection model that are below a given threshold but not far from it (e.g., at a certain distance from the threshold level) can be difficult to investigate without a pointer to an interesting event to start with. A pointer can be provided by the boosted scores reported by the anomaly detection model.

[0058] The scenario of Fig. 3C can aid in prioritization of attack detection mechanisms based on anomalies. For example, if within a given time window, the misuse detection model does not point to suspicious activity but at the same time reports several anomalous spikes of approximately equal importance, the uncertainty with prioritization can be resolved by assigning respective priorities according to, for example, the average or highest misuse detection score among the spikes.

[0059] In one embodiment of the present invention, when a security threat is detected, the security agent module is configured to generate and send a security alert to the internal network and a local center node (not shown) in the local computer network and to initiate security measures to respond to the detected security threat. Additionally, when an anomaly is identified that is presumed to be a highly likely new threat, the security agent module is configured to validate and contain the threat, generate a new model based on the collected data and received information, and share the generated new model with other nodes of the network and / or back-end systems such as the swarm intelligence network and / or the local center node and / or the internal network.

[0060] In one embodiment of the present invention, if an anomaly is determined to be a false positive, for example by a deeper analytical model or by a human analyst, a logical and / or behavioral model is trained not to detect similar and corresponding cases as anomalies again.

[0061] In one embodiment, when a deviation from normal behavior is detected, further actions may be taken to secure the computer network and / or any associated nodes, such as, for example, increasing the level of data collection, sending data that did not match the generated local behavior model and / or the received behavior model to the backend, increasing the risk level of the user, increasing the risk level of the node, and / or alerting an operator, and / or taking immediate action by modifying the settings of the node to ensure that the attacker is stopped and any traces of their movements are not destroyed. Modifying the settings may, for example, prevent one or more nodes (which may be computers or other devices) from being switched off to store information in RAM, a firewall may be switched on in one or more nodes to immediately shut down the attacker, network connectivity of one or more of the nodes may be slowed or blocked, suspicious files may be removed or placed in quarantine, logs may be collected from the nodes, a set of commands may be executed on the nodes, users of one or more nodes may be alerted that a threat or anomaly has been detected and their workstations are under investigation, and / or system updates or software patches may be sent from the EDR backend to the nodes in response to detecting an indication of a deviation from normal behavior. In one embodiment of the present invention, one or more of these actions may be automatically initiated by the model or algorithm described above. For example, using the method described above, data is collected and shared with nodes in the computer network and EDR backend, and a threat model or analysis algorithm determines that a deviation from normal behavior has been detected. As soon as the model / algorithm makes the determination that a deviation from normal behavior has been detected, it can generate and issue commands to related nodes without human intervention to automatically initiate one or more of the above actions at the node. By doing this, corruption can be stopped and / or damage can be minimized automatically at a very high speed without human intervention.

[0062] Next, some practical exemplary steps of operation according to one embodiment will be described.

[0063] Deployment and distribution of user behavior modeling components: All agents may have essentially the same code base and / or the ability to adapt to their role by activating different components within their modular architecture and replicating themselves. In one embodiment of the present invention, only one initial agent needs to be deployed within the customer network with sufficient access rights, which then discovers servers, installs copies of itself in the appropriate locations, and establishes internal communication networks, e.g., internal swarm communication networks, as well as back-end update, reporting, and communication channels. Additionally, authentication and other necessary issues may need to be considered, and agents may be deployed to individual hosts initially.

[0064] Normal operation: Agents continuously monitor their environment, collect data, learn from what they see, and build models, e.g., threat detection models. These models can be shared across swarm nodes and can be used, for example, to learn the behavior of users on one computer relative to other computers in the network. Furthermore, abstract information can be sent to the backend in a privacy-preserving manner. Agents utilize the learning models mentioned above to also be prepared to know what is normal.

[0065] Encountering a known threat: An agent that detects either a known threat or an anomaly indicative of a known threat can immediately alert its swarm mates of the situation and also prepare for the threat which may deactivate them and request additional resources if necessary (spinning up new virtual agents or having them delivered from another host if there is a risk of compromise). Known threats can be detected based on user behavior when comparing detected behavior with a behavior model. If the agent already has the means to respond, it can take that action.

[0066] Encountering new threats: Agents are constantly learning what is normal and have the ability to detect new threats in a very granular way by combining their own node's data with a broad view of global, organizational and user group level models. The ability to interact with the user is used to validate the threat and, if validated, not only can they take action to contain it but also build new threat models and distribute them through a central link to their swarm peers as well as other customers. They can also detect new threats or anomalies based on user behavior by comparing detected behavior with behavioral models and observing significant deviations. In some embodiments, the risk of a threat may be deemed too great and autonomous containment actions may be taken before a final decision is made. The degree of autonomous behavior can be constantly adjusted as needed. The connectivity model also allows for the use of human expert help when necessary.

[0067] Backend preparation: During operation, the generated behavioral models of the user and / or information about events and / or threats can be abstracted and sent to the backend at any time. This allows the backend "laboratory" to continue experimenting with more effective defense tools in a secure environment and provides further correlation and analysis of data sent from a large number of individual intelligent agents or sensors. The backend can also share threat detection models to the nodes.

[0068] As discussed above, the nature of the model used by the system (e.g., EDR) can be or incorporate one or more elements of neural networks trained using a training data set, strict or heuristic rules (e.g., hard-coded logic), modeling based on fuzzy logic, and modeling based on statistical inference. Models can be defined to take into account specific usage patterns of nodes, files, processes, connections, dependencies between processes, etc.

[0069] Although the present invention has been described above in terms of preferred embodiments, it should be understood that these embodiments are merely illustrative and that the claims are not limited to these embodiments. Those skilled in the art will be able to make modifications and alternatives in light of the disclosure that are considered to be within the scope of the appended claims. Each feature disclosed or exemplified herein may be incorporated into the present invention alone or in any suitable combination with any other feature disclosed or exemplified herein. The list and groups of examples provided in the above description are not exhaustive unless otherwise specified.

Claims

1. 1. A method for threat detection in a threat detection network, comprising: The threat detection network includes interconnected nodes (5a-5h) and a backend system (2); The back-end system (2) utilizes a back-end threat detection mechanism; At least a portion of said nodes (5a-5h) include a security agent module (6a-6h) that collects data relating to each of said nodes; said nodes (5a-5h) utilize at least one local threat detection model, including a machine learning based model of a back-end threat detection mechanism; The threat detection method includes: collecting data related to said nodes (5a-5h) by said security agent modules (6a-6h) in said nodes; applying the local threat detection model to the collected data; making security-related decisions at said nodes (5a-5h), such as endpoints, based on the results of said local threat detection models; Threat detection methods.

2. The method of claim 1 , wherein the local threat detection model including a machine learning based model of the back-end threat detection mechanism is an approximation of a back-end rule-based threat detection mechanism.

3. 3. The method of claim 1 or 2, wherein the local threat detection models include at least one misuse detection model based on at least one machine learning model for discovering events that are likely to contribute to the detection of a cyber incident.

4. The method of threat detection according to claim 3 , wherein the misuse detection model is trained in the backend system in a supervised learning manner for a classification problem.

5. 5. The threat detection method of claim 3 or claim 4, wherein the training set of the misuse detection model comprises a complementary subset of existing events that have been proven to be associated with confirmed existing cyber incidents and / or cyber attacks and / or represent typical benign behavior.

6. The local threat detection models further include at least one anomaly detection model based on at least one machine learning model for discovering uncommon events likely to contribute to threat detection, intelligence, and / or hunting objectives; and / or The method for threat detection according to any one of claims 1 to 5, wherein at least one of the anomaly detection models is trained in the backend system or the node in an unsupervised, supervised or semi-supervised learning manner.

7. Training of the misuse detection and / or anomaly detection models is performed periodically; and / or Once the training process is finished, the new model is transmitted to the nodes (5a-5h) and used locally by said nodes (5a-5h). The threat detection method according to any one of claims 3 to 6.

8. The method of threat detection according to any one of claims 1 to 7, wherein the agent (6a-6h) of the node uses the local threat detection model to obtain a score for the stream of observed local events in a timely manner and / or to arrange the observed events in order of appearance on a timeline and combine the scores assigned to the timeline by the local threat detection model.

9. Anomaly detection and / or misuse detection models are applied to the events observed on each node and overlaid on the timeline graph as a set of respective time series; and / or Threat detection method according to any one of claims 3 to 8, wherein every new event gets a score or a set of scores from the anomaly detection model and / or misuse detection model.

10. The method for threat detection according to any one of claims 1 to 9, wherein the node utilizes both an anomaly detection model and a misuse detection model in the node (5a to 5h) and uses the models together by analyzing the relationship between score patterns between the anomaly detection model and the misuse detection model.

11. The threat detection method of any one of claims 1 to 10, wherein preparing the machine learning based threat detection model comprises defining back-end threat detection mechanism features, defining local threat detection model features, and training the local threat detection model based on training data and / or the back-end threat detection mechanism.

12. A node of a threat detection network, comprising: the threat detection network includes interconnected nodes and backend systems; said nodes (5a-5h) including at least one or more processors and at least one security agent module (6a-6h) configured to collect data relating to each of said nodes; the nodes (5a-5h) are further configured to utilize local threat detection models including machine learning based models of back-end threat detection mechanisms; The nodes (5a to 5h) collecting data related to the node by the security agent module at the node; applying the local threat detection model to the collected data; making security-related decisions at said nodes (5a-5h), such as endpoints, based on the results of said local threat detection models; A node in a threat detection network.

13. Node of a threat detection network according to claim 12, wherein said nodes (5a to 5h) are adapted to execute a threat detection method according to any one of claims 2 to 11.

14. At least one node (5a-5h) according to claim 12 or claim 13, At least one backend system (2); Including, The backend system (2) includes at least one server including at least one processor; the backend system (2) is configured to utilize a backend threat detection mechanism and is further configured to train and / or provide local threat detection models, including anomaly detection models and / or misuse detection models, to the nodes (5a-5h); Threat detection network.

15. A computer program comprising instructions which, when executed by a computer, cause the computer to carry out the threat detection method according to any one of claims 1 to 11.

16. 16. A computer readable medium comprising a computer program according to claim 15.

Images