Threat detection method, computer device, and computer system

Abstract

To improve how to control complicated threats such as hacking and out-of-living attackers, exploitation, insider threats, and APTs (Advanced Persistent Threats).SOLUTION: A threat detection method comprises: detecting the start of a new process on a network node of a computer network; determining that the process requires an external code module; when the time elapsed between the start of the process and the time at which at least one external code module required by the new process is loaded is outside a predetermined expected boundary with respect to a process start time, based on determining that the use of the external code module required by the new process is abnormal, taking further action to protect the network node and / or the computer network.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a threat detection method in a computer network security system and a computer network security system. [Background technology]

[0002] Computer network security systems such as managed detection and response (MDR) and endpoint detection and response (EDR) products and services are prevalent. These systems focus on detecting and monitoring breaches both as they occur and after they occur, helping to determine how best to respond. The growth of MDR / EDR has been made possible in part by the emergence of machine learning, big data, and cloud computing.

[0003] EDR or other enabled systems deploy data collectors on selected network endpoints (which can be any element of your IT infrastructure). The data collectors monitor activity occurring on the endpoints and send the collected data to a central backend system (the "EDR backend"), which is often located in the cloud. Once the EDR backend receives the data, it is analyzed and processed (e.g., aggregated and enhanced) before being scanned by the EDR provider for signs of compromise or anomalies. Summary of the Invention [Problem to be solved by the invention]

[0004] One problem with these systems is that attackers tend to constantly change their tactics, techniques, and procedures, thus lacking in effectiveness in detecting misuse. A known tendency of attacks is to exploit trust in legitimate software applications and their originators.

[0005] Therefore, there is a need to improve how anomalies are detected and how complex threats such as hacking and exotic attackers, exploitation, insider threats, and advanced persistent threats (APTs) are controlled, especially in situations where advanced threats originate within reputable and trusted processes / executable images. [Means for solving the problem]

[0006] According to a first aspect of the present invention, there is provided a threat detection method that detects the start of a new process on a network node of a computer network, determines that the process requires an external code module, monitors the time at which at least one external code module required by the new process is loaded relative to the process start time, determines that use of the external code module required by the new process is anomalous when the time elapsed between the start of the process and the loading of the external code module is outside a predetermined expected boundary, and takes further action to protect the network node and / or the computer network based on the detected determination that use of the external code module required by the new process is anomalous.

[0007] According to a second aspect of the present invention, there is provided a computer device including at least one processor configured to detect the start of a new process at a network node of a computer network, determine that the process requires an external code module, monitor a time at which at least one external code module required by the new process is loaded relative to a process start time, determine that usage of the external code module required by the new process is anomalous when the time elapsed between the start of the process and the loading of the external code module is outside a predetermined expected boundary, and take further action to protect the network node and / or the computer network based on the detected determination that usage of the external code module required by the new process is anomalous.

[0008] According to a third aspect of the present invention there is provided a computer program product comprising a computer storage medium having stored thereon computer code which, when executed on a computer system, causes the system to operate as a computer apparatus according to the second aspect of the present invention. [Effects of the Invention]

[0009] Improve how anomalies are detected and how complex threats such as hacking and off-site attackers, exploitation, insider threats, and advanced persistent threats (APTs) are controlled. [Brief explanation of the drawings]

[0010] [Figure 1] 1 illustrates a schematic network architecture. [Figure 2] FIG. 1 is a flow diagram illustrating a method according to one embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] FIG. 1 schematically illustrates a portion of a first computer network 1 on which a computer system, e.g., an EDR system, is installed. Any other computer system capable of implementing embodiments of the present invention may be used instead of or in addition to the EDR system used in this example. The first computer network is connected to an EDR backend 2 via a cloud 3. The EDR backend 2 forms a node on a second computer network relative to the first computer network. The second computer network is managed by an EDR system provider and may be separated from the cloud 3 by a gateway or other interface (not shown) or other network element appropriate to the EDR backend 2. The first computer network 1 may be separated from the cloud 3 by a gateway 4 or other interface. Other network structures are also contemplated. While the example of FIG. 1 illustrates elements as separate or combined entities, the elements may be implemented in any other combination, whether separate and / or combined.

[0012] The first computer network 1 is formed from multiple interconnected network nodes 5a-5h, each of which represents an element within the computer network 1, such as a computer, smartphone, tablet, laptop, or other network-connectable hardware. Each of the network nodes 5a-5h shown in the computer network also represents an EDR endpoint on which a data collector (or "sensor") 6a-6h is installed. Data collectors may also be installed on other elements of the computer network, such as gateways or other interfaces. Data collector 4a is installed on gateway 4 in FIG. 1. Data collectors 6a-6h, 4a collect various types of data at the network nodes 5a-5h or gateway 4, including, for example, program or file hashes, files stored on nodes 5a-5h, network traffic logs, process logs, binaries or files excised from memory (e.g., DLLs, EXEs, or memory forensic artifacts), and / or logs (e.g., TCP dumps) from monitoring actions performed by programs or scripts running on the nodes 5a-5h or gateway 4.

[0013] It is envisioned that any type of data that can assist in detecting and monitoring security breaches may be collected by the data collectors 6a-6h, 4a during their lifecycle, and the type of data monitored and collected may be configured according to rules defined by the EDR system provider at the time of EDR system installation or in response to instructions from the EDR backend 2. For example, the data collectors 6a-6h, 4a may collect data regarding the behavior of programs running on the EDR endpoints and may observe when new programs are started. If appropriate resources are available, the collected data may be stored by the data collectors 6a-6h, 4a either permanently or temporarily on their respective nodes or in an appropriate storage location (not shown) on the first computer network 1.

[0014] The data collectors 6a-6h, 4a may also perform some simple pre-processing steps on the collected data, but this is limited by the computing and network resources available at each network node 5a-5h or gateway 4.

[0015] The data collectors 6a-6h, 4a are set up to transmit information such as collected data and to send and receive instructions to and from the EDR backend 2 via the cloud 3. This allows the EDR system provider to remotely manage the EDR system without having to maintain a constant human presence in the facility managing the first computer network 1.

[0016] The modules 6a-6h, 4a may be further configured to use the collected data and information received from the network to generate and adapt models associated with each of the network nodes 5a-5h. For example, if a known security threat is detected, the modules 6a-6h, 4a may be configured to generate and transmit security alerts to network nodes within the local computer network and activate security countermeasures to address the detected security threat. Furthermore, if an anomaly is identified that is highly likely to be a new threat, the modules 6a-6h, 4a may be configured to verify and contain the threat, generate a new threat model based on the collected data and received information, and share the generated new threat model within the computer network.

[0017] 2 is a flow diagram illustrating a method according to one embodiment. The method steps described in this example can be processed by a security server backend, one or more network nodes (endpoints) of a computer network, or a combination thereof.

[0018] The method begins at S201 where computer processes of a network node, such as an endpoint node of a computer network, are monitored.

[0019] If a new process start is detected in the network node in S202, the process proceeds to S203. If not, the process returns to S201 and continues to monitor the computer process.

[0020] In S203, it is determined whether the detected new process requires an external code module. In one embodiment, the use of external code modules can be determined using differential analysis. For example, the file contents of the executable image associated with the process can be processed to retrieve a list of external code modules that can be used by the process. This can include, but is not limited to, processing import tables (e.g., Import Table, Delayed Import Table, .dynsym / .dynstr sections), processing code, and extracting various artifacts (e.g., strings, resource tables).

[0021] In one embodiment, information about new code modules being loaded and unloaded can be collected by dynamic analysis methods such as F-Secure's xDR sensors, Sandviper, debuggers, emulators, or dynamic instrumentation.

[0022] In one embodiment, for each load or unload of a new code module, if the code module is not listed in the expected code module load list, the code module is marked as a delayed (implicit) load event and the suspiciousness level of the original event is increased; if the loaded module is intentionally clean, widespread, and used for a specific, non-mainstream purpose, the suspiciousness level of the original event is increased again and the event is marked for further investigation.

[0023] If in S203 it is determined that the new process requires external code modules, proceed to S204 and observe the time that one or more of the external code modules required by the new process are loaded relative to the start time of the new process.

[0024] In S205, if the time elapsed between the start of the new process and the loading of the external code module is outside of a predetermined expected boundary, the process proceeds to S206, where it is determined that the use of the external code module required by the new process is abnormal. If the time elapsed between the start of the new process and the loading of the external code module does not exceed the predetermined expected boundary, the process proceeds to S208, where it is determined that the use of the external code module required by the new process is not abnormal.

[0025] In S207, further action is taken to protect the network node and / or the computer network based on determining that the use of the external code module required by the detected new process is anomalous.

[0026] In one embodiment, detection of anomalous external module loading is based on a process timeline analysis. Threat identification can be based on detecting that the time difference between observed times (start time of a new process vs. external code module load time) exceeds a predetermined limit. Delayed external code module loading can also be detected without prior knowledge of the external code module required by the process. For this purpose, relevant information related to past observations can be used. The recognition that similar code modules are used by similar processes can be used in the determination. Similarity between processes can be defined by looking at various attributes. For this purpose, it can be defined whether the file names of the executable images for these processes are sufficiently similar or whether portions of the executable image content match sufficiently strongly (e.g., using SSDEEP, IMPHASH, SHA256, etc.). Similarity between code modules can be defined by any criteria valid for the process's executable file. Furthermore, the time when the additional code module was loaded relative to the start of process execution is determined. This data can be searched, for example, using dynamic analysis methods.

[0027] In one embodiment, detection of delayed external code modules can be configured by applying various machine learning anomaly detection approaches, and the models can represent the time delay distribution of the process and module or similar processes and modules (with the time scale normalized if a different dynamic framework / data collection approach is applied), the module usage distribution of the process or similar processes, and / or the process usage distribution of the module or similar modules.

[0028] In one embodiment, the new process includes an execution of one or more of a code module, a dynamic load library, or a shared object.

[0029] In one embodiment, the method further includes determining whether an associated executable image for the new process is known to be clean by determining whether the executable image meets one or more predetermined whitelist criteria. In one embodiment, for processes whose associated executable image is known to be clean, i.e., whose executable image meets one or more explicit whitelist criteria (e.g., a file with a valid Authenticode signature from a trusted manufacturer or a file that is part of the primary operating system), it is determined whether the use of an external code module for this process is anomalous. This determination can be made in a variety of different ways, as described above.

[0030] In one embodiment, the method further includes processing file contents of the associated executable image to retrieve a list of expected external code modules that may be used by the new process. Processing the file contents may include one or more of processing import tables, processing code, and extracting various artifacts.

[0031] In one embodiment, the method further collects information about new code modules being loaded or unloaded, and in connection with the loading or unloading of all new code modules, the method increases the level of suspicion of the new process if the new code module is not in the list of external code modules expected to be loaded / unloaded.

[0032] In one embodiment, determining whether the use of the external code module required by the new process is anomalous is further based on determining that the external code module required by the new process belongs to a group of known processes that have sufficiently similar characteristics based on comparing file names of executable images for the processes and / or comparing portions of content of executable images for the processes.

[0033] In one embodiment, taking further action to secure the computer network and / or any associated network nodes includes one or more of the following: preventing one or more network nodes from being switched off; switching on a firewall on one or more network nodes; alerting users of one or more network nodes where signs of a security breach have been detected; and / or sending software updates to one or more network nodes.

[0034] In one embodiment, further actions taken based on determining that the use of an external code module required by the new process is anomalous may include taking immediate action by changing the configuration of the network node to ensure that the attacker is stopped and traces of their activity are not destroyed. The configuration changes may include, for example, preventing one or more nodes (which may be computers or other devices) from being switched off to preserve information in RAM, switching on firewalls at one or more nodes to immediately shut off the attacker, alerting users of one or more nodes that a compromise has been detected and that their workstations are under investigation, and / or sending system updates or software patches to the nodes from the EDR backend 2 in response to detecting an indication of compromise. It is envisioned that one or more of these actions may be automatically initiated by the above-described algorithm. For example, data may be collected and sent from nodes in the computer network 1 to the EDR backend 2 using the above-described method. The analysis algorithm determines that a threat has been detected. Once the algorithm determines that an indication of a threat has been detected, it may generate and issue commands to the associated network node without human intervention to automatically initiate one or more of the above-described actions at the node. By doing this, possible breaches can be stopped and / or damage minimized automatically, without human intervention, very quickly.

[0035] In general, the proposed approach introduces a number of improvements over conventional threat detection schemes, including, for example, the ability to detect advanced threats that dynamically load code at later stages of execution, especially in situations where this occurs inside a reputable and trusted process or executable image.

[0036] Another improvement according to one embodiment is the ability to detect anomalous and potentially malicious activity based on the timing of dynamic code loads. This is particularly beneficial in situations where the entity under monitoring is trusted and other data is scarce or too costly to compute. Thus, the present invention provides a highly effective threat detection scheme while reducing the amount of data required for threat detection, thereby conserving computer system resources and saving costs.

[0037] Furthermore, the proposed threat detection scheme can detect anomalies in how external modules are used, making it extremely useful, for example, in cases such as the supply chain attacks seen recently, and when shellcodes or external payloads are used by attackers.

[0038] Any suitable computer network system, server, endpoint node / device, and computing device as described herein may each perform or contribute to a threat detection method according to an embodiment of the present invention. The processor of such a system is configured to execute computer program instructions based on the methods and processes described herein, with such instructions stored in a non-transitory computer-readable medium, such as a memory. The computer program instructions may be loaded into the memory from another computer-readable medium or from another device via a communications interface. The instructions contained in the memory cause the processor of the computing device to perform a process or method as described herein. Alternatively, or in addition, hardwired circuitry may be used in place of or in combination with computer program instructions to implement processes and methods consistent with the present invention. Examples of hardware circuitry include, but are not limited to, semiconductor chips, integrated circuits, field programmable gate arrays, application-specific integrated circuits, electronically programmable integrated circuits, etc. Accordingly, the present invention is not limited to any specific combination of hardware circuitry and / or software.

[0039] The non-transitory computer-readable medium includes computer program instructions stored thereon that, when executed on one or more processors of a server, server system, or other computing system, perform steps of a threat detection process or method and take further action to protect a network node and / or computer network based on determining that the use of an external code module required by a new process is anomalous, as described herein with reference to FIGS. 1 and 2 .

[0040] While the present invention has been described with reference to preferred embodiments as described above, it should be understood that these embodiments are merely exemplary and that the claims are not limited to these embodiments. Those skilled in the art will be able to make modifications and substitutions in light of the disclosure that are believed to be within the scope of the appended claims. Each feature disclosed or exemplified herein may be incorporated into the present invention, whether alone or in any suitable combination, with any other feature disclosed or exemplified herein. [Explanation of symbols]

[0041] 2. EDR Backend 3. Cloud 4 Gateway 4a Data Collector 5a~5h Network Node 6a~6h Data Collector

Claims

1. At least one processor: Detecting the start of a new process on a network node of a computer network; determining that the process requires an external code module; monitoring the time at which at least one external code module required by the new process is loaded relative to the process start time; determining that the use of the external code module requested by the new process is abnormal when the time elapsed between the start of the process and the loading of the external code module is outside predetermined expected bounds; taking further action to protect the network node and / or the computer network based on determining that the use of the external code module required by the detected new process is anomalous; processing the file contents of the associated executable image to extract a list of expected external code modules that may be used by the new process; 1. A threat detection method, comprising: Dynamically gathers information about new code modules being loaded or unloaded, In relation to the loading or unloading of every new code module, increasing the suspiciousness level of the new process if the new code module load / unload is not in the list of expected external code modules; Threat detection methods.

2. the new process includes execution of at least one of a code module, a dynamic load library, and a shared object; The threat detection method of claim 1 .

3. determining whether an associated executable image for the new process is known to be clean; The associated executable image for the new process is known to be clean. determining whether the executable image satisfies at least one predetermined whitelist criterion; The threat detection method of claim 1 .

4. Processing the file contents includes at least one of processing import tables, processing code, and extracting various artifacts. The threat detection method of claim 1 .

5. determining whether the use of an external code module required by the new process is anomalous is further based on determining that the external code module required by the new process belongs to a group of known processes having sufficiently similar characteristics based on comparing file names of executable images for the processes and / or comparing portions of content of executable images for the processes; The threat detection method of claim 1 .

6. taking further action to protect the network node and / or computer network; Preventing at least one of said network nodes from being switched off; Switching on a firewall of at least one of said network nodes; - alerting a user of at least one of said network nodes where an indication of a security breach has been detected; and / or transmitting a software update to at least one of said network nodes; at least one of The threat detection method of claim 1 .

7. Detecting the start of a new process on a network node of a computer network; determining that the process requires an external code module; monitoring the time at which at least one external code module required by the new process is loaded relative to the process start time; determining that the use of the external code module requested by the new process is abnormal when the time elapsed between the start of the process and the loading of the external code module is outside predetermined expected bounds; taking further action to protect the network node and / or the computer network based on determining that the use of the external code module required by the detected new process is anomalous; processing the file contents of the associated executable image to extract a list of expected external code modules that may be used by the new process; at least one processor configured to: The processor further comprises: Dynamically gathers information about new code modules being loaded or unloaded, In relation to the loading or unloading of every new code module, increasing the suspiciousness level of the new process if the new code module load / unload is not in the list of expected external code modules; It is configured as follows: Computer equipment.

8. the new process includes execution of at least one of a code module, a dynamic load library, and a shared object; 8. The computer device of claim 7.

9. The processor further comprises: determining whether the associated executable image for the new process is known to be clean; It is configured as follows: determining whether an associated executable image for the new process is known to be clean includes determining whether the executable image satisfies at least one predetermined whitelist criterion; 8. The computer device of claim 7.

10. Processing the file contents includes at least one of processing import tables, processing code, and extracting various artifacts.

8. The computer device of claim 7.

11. The processor further comprises: determining whether the use of the external code module required by the new process is anomalous based on determining that the external code module required by the new process belongs to a group of known processes having sufficiently similar characteristics based on comparing file names of executable images for the processes and / or comparing portions of content of executable images for the processes; It is configured as follows:

8. The computer device of claim 7.

12. taking further action to protect the network node and / or computer network; Preventing at least one of said network nodes from being switched off; Switching on a firewall of at least one of said network nodes; - alerting a user of at least one of said network nodes where an indication of a security breach has been detected; and / or transmitting a software update to at least one of said network nodes; at least one of 8. The computer device of claim 7.

13. A computer program comprising computer readable code which, when executed on a computing device, causes said computing device to operate as the computing device of claim 7.

14. 14. A computer system including the computer program of claim 13 and a non-transitory computer readable medium, wherein the computer program is stored on the non-transitory computer readable medium.

Images