Graphhunter: a method for automation of threat identification in an SOC environment

Abstract

Methods and systems for identifying cybersecurity threats construct a graph from a CISA security alert and traverse the graph to identify a cybersecurity threat by monitoring data in the system and updating the state of the graph. Tactics in the CISA alert are represented by nodes in the graph, techniques in the CISA security alert represented by edges in the graph Traversing the graph is performed by receiving information from the system and for each graph representing an attack model comparing the attack model graph to the received information to identify a match and updating the graph state based on the match. Updated graphs may be displayed to a user showing the state of an attack vector in the graph. The state of the attack vectors may be updated with information from the system and displayed in a color corresponding to a traffic signal.

Description

GRAPHHUNTER: A METHOD FOR AUTOMATION OF THREAT IDENTIFICATION IN AN SOC ENVIRONMENTTECHNICAL FIELD

[0001] This application relates to the identification of security threats in a system using a Security Operations Center (SOC).BACKGROUND

[0002] In monitoring security operations, detected events and alerts must be correlated with a known security vulnerability to identify and mitigate attacks. Traditionally, a sequence of events and alerts need to be analyzed by a SOC analyst to use skill and judgment to identify a security vulnerability based on a series of events and / or alerts. This analysis is dependent on the skill and experience of the SOC analyst and threat identification is generally reserved for SOC analysts in upper tiers of experience and knowledge. A method of correlating event and alert data to identify a potential threat while addressing the above drawbacks is desired.SUMMARY

[0003] Methods identifying cybersecurity threats in a system include constructing a graph from a CISA security alert representing an attack model and traversing the graph to identify a source of a cybersecurity threat based on monitoring data in the system and comparing the monitored data with a state of one or more of the attack models to update the graph. Constructing the graph from the CISA security alert may include text of the CISA security alert then for each tactic in the CISA security alert creating a state or node in the graph, and for each technique in the CISA security alert creating an edge in the graph connecting a first and second state or node in the graph. Traversing the graph is performed by receiving information from the system and for each graph representing an attack model comparing the attack model graph to the receivedinformation to identify a match and updating the graph state based on the match. In a user interface one or more updated graph representative of a process state for a corresponding attack model may be displayed to a user. The display may include multiple attack models based on the attack model's corresponding updated graphs. The state of the attack vectors may be updated with information from the system and displayed in a color to indicate a risk level associated with the state of the node. The colors displayed may correspond to a traffic signal, displaying the nodes as one of red, yellow and green. The color of each node represents the execution state of the attack model in the system. A combined graph may be created by combining more than one attack model graph, using a cartesian product.

[0004] A system for monitoring a system for cybersecurity events includes a computer processor and a non-transitory computer memory in communication with the computer processor. The non-transitory computer memory stores instructions that when executed by the computer processor cause the computer processor to construct a finite state machine graph based on a textual CISA threat model. Further, instructions may include updating a state of the finite state graph based on information received from the monitored system. The graph of the finite state graph may be updated based on activity logs produced by the system. The system may display to a user via a user interface one or more of the updated finite state machine graphs, each representing a cybersecurity attack model. The nodes of the updated finite machine graph may be displayed in a color to indicate a risk level associated with the state of the node. The colors displayed may correspond to a traffic signal, displaying the nodes as one of red, yellow and green. Finite state graphs may be updated upon receiving additional information from the system and used to update the finite state machine to indicate a status of a cybersecurity attack vector to a user. The system may be configured toperiodically receive log and alert information from the system; and update one or more finite state graphs based on the received information, brief description of the drawings

[0005] The foregoing and other aspects of the present invention are best understood from the following detailed description when read in connection with the accompanying drawings. For the purpose of illustrating the invention, there is shown in the drawings embodiments that are presently preferred, it being understood, however, that the invention is not limited to the specific instrumentalities disclosed. Included in the drawings are the following Figures:

[0006] FIG. 1 is a diagram of a National Standards and Technology (NIST) incident response life cycle.

[0007] FIG. 2 is a process flow diagram for creating a finite state machine graph from a text CISA security alert according to aspects of embodiments of this disclosure.

[0008] FIG. 3 is a process flow diagram for traversing and updating a finite state machine graph representing an attack model according to aspects of embodiments of this disclosure.

[0009] FIG. 4 is a block diagram for using a finite state machine according to aspects of embodiments of this disclosure.

[0010] FIG. 5 is an illustration of a user interface for presenting attack model vectors in a finite state machine graph according to aspects of embodiments of this disclosure.

[0011] FIG. 6 is an illustration of applying a cartesian product to two finite state machine graphs to create a combined graph according to aspects of embodiments of this disclosure.

[0012] FIG. 7 is a block diagram of a computing system for implementing the methods and systems for creating and traversing graphs of attack models according to aspects of embodiment of this disclosure.DETAILED DESCRIPTION

[0013] FIG. 1 is a diagram showing the National Standards and Technology (NIST) incident response life cycle 100. The life cycle 100 is divided into four steps including preparation 110, detection and analysis 120, containment, eradication and recovery 130, and post-incident activity 140. Preparation for incidents includes compiling a list of IT assets such as networks, servers and endpoints, identifying their importance and which ones are critical or hold sensitive data. Monitoring is set up to establish a baseline of normal activity. Preparation includes determining which types of security events should be investigated and create detailed response steps for common types of incidents.

[0014] Detection involves collecting data from IT systems, security tools, publicly available information and people inside and outside the organization then identifying precursors (signs that an incident may happen in the future) and indicators (data showing that an attack has happened or is happening now). Analysis involves identifying a baseline or normal activity for the affected systems, correlating related events and seeing if and how they deviate from normal behavior.

[0015] The goal of containment is to stop an attack before it overwhelms resources or causes damage. Containment strategy will depend on the level of damage the incident may cause, the need to keep critical services available to employees and customers, and the duration of the solution, e.g., a temporary solution for a few hours, days or weeks, or a permanent solution. As part of containment, it is important toidentify the attacking host and validate its IP address. This allows blocking communication from the attacker and also identifying the threat actor to understand their mode of operation, search for and block other communication channels they may be using. In the eradication and recovery stage, after the incident has been successfully contained, action should be taken to remove all elements of the incident from the environment. This might include identifying all affected hosts, removing malware, and closing or resetting passwords for breached user accounts. Finally, once the threat is eradicated, systems must be restored and normal operations must be returned as quickly as possible, taking steps to ensure the same assets are not attacked again.

[0016] Post incident activities include asking pertinent questions to learn from previous incidents and use the knowledge to improve the overall process, adjust reporting plans and procedures and provide new information to the preparation stage 110.

[0017] The NIST process does not reflect a linear process that starts when an incident is detected and ends with the eradication and recovery from the incident. Instead, the life cycle of an incident response is cyclical where continued learning and improvements to learn to better defend against security vulnerabilities. For example, after each incident during post-incident activity 140, there is typically great effort expended to document and investigate what happened during the incident. The results of this investigation provide information 145 back to earlier stages of the life cycle 100 to enable better preparation 110 and detection of future incidents 120. It is not uncommon that many parts of an attack are not fully understood at the detection stage 120 and only become evident when investigators investigate the environment around the attack. Lessons that are learned may be fed back to the detection stage to assist in detecting and analyzing attacks more comprehensively in the future.

[0018] Embodiments of this disclosure address these shortcomings in a manual review process of cybersecurity events. While presently, alerts of potential cybersecurity threats are received in a tabular form, embodiments of this disclosure provide a novel representation of an attack is graph based. This format allows an analyst to navigate through the graph to identify threats and attacks that are not possible using tabular data. Embodiments herein provide for creating a graph based finite state machine representative of each attack model and a process for traversing the graph and comparing states of the system to states of the attack models to identify anomalies or attacks. The attack models may be created in graph form using the textual data available in CIST alerts.

[0019] FIG. 2 is a process flow diagram showing the creation of an attack model graph based on the text of a CISA cybersecurity alert according to aspects of embodiments of this disclosure. The text of a CISA alert 201 serves as an input to the process 200. The CISA alert 201 contains tactics and techniques associated with the alert. Tactics will act as nodes in the output graph 230, while techniques will act as edges that connect the nodes in the output graph 230. From a first tactic, an initial state is created, and a previous state variable is initialized to the initial state 203. Each tactic and each technique in the alert is processed to organize the nodes and edges of the output graph 230. After creating the initial state 203, a next unprocessed tactic is retrieved 210. If no unprocessed tactics are remaining 211 , then the process 200 ends by outputting the updated graph 230. If an unprocessed tactic remains 212, a new state is created for the tactic 213, a current state variable is set to the newly created state 214. At this point, each technique will be examined to define the edges representing transitions from one state (or tactic) to another in the graph. An unprocessed technique that relates to the tactic currently under consideration is retrieved 220. If no furthertechniques remain 225, the process 200 returns to select the next unprocessed tactic 210. If an unprocessed technique remains 221 , an edge is created representing the technique from the previous state to the current state 222. Once the edge is created 222, the previous state is updated to the current state 223 to prepare for processing the next technique 220. Once all tactics and all techniques have been processed, the final updated graph representing the attack specified in the CISA alert is output 230.

[0020] FIG. 3 is a process flow for interpreting one or more attack graphs created by the process of FIG. 2. The process begins with the library of attack graphs 302 and logs and alerts generated by the system 301. The process will be executed for each available attack graph 302. A remaining unprocessed attack graph is retrieved 310. If no more unprocessed attack graphs exist 312 the process ends 340. If an unprocessed attack graph remains 311 then using the edges of the attack graph, a query is performed to match the given technique to information contained in the logs and alerts 301 . For each match, a next unprocessed match is retrieved 320. If no further matches exist 322, then the next attack graph is retrieved 310. If a match remains 321 , then the designation node in the graph is set to active 325. The status of the source node is then checked 330, if the source node is in an active state 331 , the graph is updated properly 335. If, on the other hand, the source node state is not active 332, then all states (or nodes) that lead to the current destination node are set to a state of "uncertain" 333.

[0021] FIG. 4 is a block diagram for the use of a CISA cybersecurity alert as a finite state machine. From a starting state 401 , a first action indicative of an initial access is detected. For example, if a report of phishing occurs 403, a public facing app containing an exploit is detected 405, or an exploit of an external service is detected 407, then an indicator (e.g., light) is activated or turned on 409. Upon initial access, a further action such as the clicking of a malicious link 411 , or a malicious file attachment is downloaded413, then a status indicator for execution 415 is activated or lit. Upon a verified execution state, an action such as modification of a system process is detected to activate a state of persistence 419. Once a persistence state is active, an act of data encryption 421 may be detected and serve as an activator for an impact state to become active 423. As a series of states and detectible actions, the alert may be transformed into a graph that acts as a finite state machine, which can function to automate the detection and alerting of cybersecurity vulnerabilities and detection based on the status states of the finite state machine.

[0022] FIG. 5 shows and example of a user interface 510 that may be used in conjunction with finite state machines to graphically display attack information to a user according to embodiments of this disclosure. One or more detected attacks 501 may be modeled using a finite state model 503 as described above with reference to FIG.5. The states in the finite state models may be used to provide traffic signal indicators providing red, yellow and green indicators that represent the criticality of the detected actions.

[0023] FIG. 6 illustrates the combination of a first attack model graph 610 and a second attack model graph 620 by applying a cartesian product 630 to produce a combined graph 640. The resulting combined model 640 provides additional transitions between states that are not in the initial models generated from CISA alerts. The transitions that emerge from the combining of the graphs may represent new attack vectors that may be used to attack the system. The combined graphs 640 may be compared to system data to identify if a new attack vector is being exploited and display the status of the attack vector to a user.

[0024] FIG. 7 illustrates an exemplary computing environment 700 within which embodiments of the invention may be implemented. Computers and computingenvironments, such as computer system 710 and computing environment 700, are known to those of skill in the art and thus are described briefly here.

[0025] As shown in FIG. 7, the computer system 710 may include a communication mechanism such as a system bus 721 or other communication mechanism for communicating information within the computer system 710. The computer system 710 further includes one or more processors 720 coupled with the system bus 721 for processing the information.

[0026] The processors 720 may include one or more central processing units (CPUs), graphical processing units (GPUs), or any other processor known in the art. More generally, a processor as used herein is a device for executing machine-readable instructions stored on a computer readable medium, for performing tasks and may comprise any one or combination of, hardware and firmware. A processor may also comprise memory storing machine-readable instructions executable for performing tasks. A processor acts upon information by manipulating, analyzing, modifying, converting or transmitting information for use by an executable procedure or an information device, and / or by routing the information to an output device. A processor may use or comprise the capabilities of a computer, controller or microprocessor, for example, and be conditioned using executable instructions to perform special purpose functions not performed by a general-purpose computer. A processor may be coupled (electrically and / or as comprising executable components) with any other processor enabling interaction and / or communication there-between. A user interface processor or generator is a known element comprising electronic circuitry or software or a combination of both for generating display images or portions thereof. A user interface comprises one or more display images enabling user interaction with a processor or other device.

[0027] Continuing with reference to FIG. 7, the computer system 710 also includes a system memory 730 coupled to the system bus 721 for storing information and instructions to be executed by processors 720. The system memory 730 may include computer readable storage media in the form of volatile and / or nonvolatile memory, such as read only memory (ROM) 731 and / or random-access memory (RAM) 732. The RAM 732 may include other dynamic storage device(s) (e.g., dynamic RAM, static RAM, and synchronous DRAM). The ROM 731 may include other static storage device(s) (e.g., programmable ROM, erasable PROM, and electrically erasable PROM). In addition, the system memory 730 may be used for storing temporary variables or other intermediate information during the execution of instructions by the processors 720. A basic input / output system 733 (BIOS) containing the basic routines that help to transfer information between elements within computer system 710, such as during start-up, may be stored in the ROM 731 . RAM 732 may contain data and / or program modules that are immediately accessible to and / or presently being operated on by the processors 720. System memory 730 may additionally include, for example, operating system 734, application programs 735, other program modules 736 and program data 737.

[0028] The computer system 710 also includes a disk controller 740 coupled to the system bus 721 to control one or more storage devices for storing information and instructions, such as a magnetic hard disk 741 and a removable media drive 742 (e.g., floppy disk drive, compact disc drive, tape drive, and / or solid-state drive). Storage devices may be added to the computer system 710 using an appropriate device interface (e.g., a small computer system interface (SCSI), integrated device electronics (IDE), Universal Serial Bus (USB), or FireWire).

[0029] The computer system 710 may also include a display controller 765 coupled to the system bus 721 to control a display or monitor 766, such as a cathode ray tube (CRT) or liquid crystal display (LCD), for displaying information to a computer user. The computer system includes an input interface 760 and one or more input devices, such as a keyboard 762 and a pointing device 761 , for interacting with a computer user and providing information to the processors 720. The pointing device 761 , for example, may be a mouse, a light pen, a trackball, or a pointing stick for communicating direction information and command selections to the processors 720 and for controlling cursor movement on the display 766. The display 766 may provide a touch screen interface which allows input to supplement or replace the communication of direction information and command selections by the pointing device 761. In some embodiments, an augmented reality device 767 that is wearable by a user, may provide input / output functionality allowing a user to interact with both a physical and virtual world. The augmented reality device 767 is in communication with the display controller 765 and the user input interface 760 allowing a user to interact with virtual items generated in the augmented reality device 767 by the display controller 765. The user may also provide gestures that are detected by the augmented reality device 767 and transmitted to the user input interface 760 as input signals.

[0030] The computer system 710 may perform a portion or all of the processing steps of embodiments of the invention in response to the processors 720 executing one or more sequences of one or more instructions contained in a memory, such as the system memory 730. Such instructions may be read into the system memory 730 from another computer readable medium, such as a magnetic hard disk 741 or a removable media drive 742. The magnetic hard disk 741 may contain one or more datastores and data files used by embodiments of the present invention. Datastorecontents and data files may be encrypted to improve security. The processors 720 may also be employed in a multi-processing arrangement to execute the one or more sequences of instructions contained in system memory 730. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions. Thus, embodiments are not limited to any specific combination of hardware circuitry and software.

[0031] As stated above, the computer system 710 may include at least one computer readable medium or memory for holding instructions programmed according to embodiments of the invention and for containing data structures, tables, records, or other data described herein. The term “computer readable medium” as used herein refers to any medium that participates in providing instructions to the processors 720 for execution. A computer readable medium may take many forms including, but not limited to, non-transitory, non-volatile media, volatile media, and transmission media. Non-limiting examples of non-volatile media include optical disks, solid state drives, magnetic disks, and magneto-optical disks, such as magnetic hard disk 741 or removable media drive 742. Non-limiting examples of volatile media include dynamic memory, such as system memory 730. Non-limiting examples of transmission media include coaxial cables, copper wire, and fiber optics, including the wires that make up the system bus 721. Transmission media may also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications.

[0032] The computing environment 700 may further include the computer system 710 operating in a networked environment using logical connections to one or more remote computers, such as remote computing device 780. Remote computing device 780 may be a personal computer (laptop or desktop), a mobile device, a server, a router, a network PC, a peer device or other common network node, and typicallyincludes many or all of the elements described above relative to computer system 710. When used in a networking environment, computer system 710 may include modem 772 for establishing communications over a network 771 , such as the Internet. Modem 772 may be connected to system bus 721 via user network interface 770, or via another appropriate mechanism.

[0033] Network 771 may be any network or system generally known in the art, including the Internet, an intranet, a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a direct connection or series of connections, a cellular telephone network, or any other network or medium capable of facilitating communication between computer system 710 and other computers (e.g., remote computing device 780). The network 771 may be wired, wireless or a combination thereof. Wired connections may be implemented using Ethernet, Universal Serial Bus (USB), RJ-6, or any other wired connection generally known in the art. Wireless connections may be implemented using Wi-Fi, WiMAX, and Bluetooth, infrared, cellular networks, satellite or any other wireless connection methodology generally known in the art. Additionally, several networks may work alone or in communication with each other to facilitate communication in the network 771 .

[0034] An executable application, as used herein, comprises code or machine- readable instructions for conditioning the processor to implement predetermined functions, such as those of an operating system, a context data acquisition system or other information processing system, for example, in response to user command or input. An executable procedure is a segment of code or machine-readable instruction, sub-routine, or other distinct section of code or portion of an executable application for performing one or more particular processes. These processes may include receiving input data and / or parameters, performing operations on received input data and / orperforming functions in response to received input parameters, and providing resulting output data and / or parameters. Each known attack 501 may be modeled and displayed as a set of states with each state having a color relating to its status based on the modeling. The different attacks may be displayed to a user. For example, the user interface 510 may include a graphic for a compromised credential vector 511 , a weak credentials attack model 512, a ransomware attack model 513, and / or an insider threat attack model 514. These graphics are arranged for display to a user and provide a quick assessment of a given threat to guide the SOC operator in actions to be taken, and the urgency or priority of each action.

[0035] A graphical user interface (GUI), as used herein, comprises one or more display images, generated by a display processor and enabling user interaction with a processor or other device and associated data acquisition and processing functions. The GUI also includes an executable procedure or executable application. The executable procedure or executable application conditions the display processor to generate signals representing the GUI display images. These signals are supplied to a display device which displays the image for viewing by the user. The processor, under control of an executable procedure or executable application, manipulates the GUI display images in response to signals received from the input devices. In this way, the user may interact with the display image using the input devices, enabling user interaction with the processor or other device.

[0036] The functions and process steps herein may be performed automatically or wholly or partially in response to user command. An activity (including a step) performed automatically is performed in response to one or more executable instructions or device operation without user direct initiation of the activity.

[0037] The system and processes of the figures are not exclusive. Other systems, processes and menus may be derived in accordance with the principles of the invention to accomplish the same objectives. Although this invention has been described with reference to particular embodiments, it is to be understood that the embodiments and variations shown and described herein are for illustration purposes only. Modifications to the current design may be implemented by those skilled in the art, without departing from the scope of the invention. As described herein, the various systems, subsystems, agents, managers and processes can be implemented using hardware components, software components, and / or combinations thereof.

Claims

CLAIMSWhat is claimed is:1 . A method for identifying cybersecurity threats in a system comprising: constructing a graph from a CISA security alert representing an attack model; and traversing the graph to identify a source of the cybersecurity threat based on monitoring data in the system and comparing the monitored data with a state of one or more of the attack models to update the graph.

2. The method of Claim 1 , wherein constructing the graph from the CISA security alert comprises: receiving text of the CISA security alert; for each tactic in the CISA security alert creating a state in the graph; and for each technique in the CISA security alert, creating an edge in the graph connecting a first state and a second state in the graph.

3. The method of Claim 1 , wherein traversing the graph comprises: receiving information from the system; for each graph representing an attack model: compare the graph to the received information to identify a match; update the graph state based on the match.

4. The method of Claim 1 , further comprising: in a user interface, displaying an updated graph representative of a process state for a corresponding attack model.

5. The method of Claim 4, further comprising displaying in the user interface, a plurality of attack models based on the attack model's corresponding updated graph.

6. The method of Claim 5, further comprising displaying to a user an attack vector based on an attack model, wherein the state of the attack vector is updated with information from the system.

7. The method of Claim 4, further comprising: displaying a current state of the one or more updated graphs by displaying the nodes of the updated graph in a color to indicate a risk level associated with the state of the node.

8. The method of Claim 5, wherein the colors displayed correspond to a traffic signal, displaying the nodes as one of red, yellow and green.

9. The method of Claim 8, wherein the color of each node represents the execution state of the attack model in the system.

10. The method of Claim 1 , further comprising generating a graph combining more than one attack model graph, using a cartesian product of the more than one graph.

11. A system for monitoring a system for cybersecurity events comprising: a computer processor; a non-transitory computer memory in communication with the computer processor, the non-transitory computer memory storing instructions that when executed by the computer processor cause the computer processor to: construct finite state machine graph based on a textual CISA threat model.

12. The system of Claim 11 , the non-transitory computer memory storing instructions that when executed by the computer processor cause the computer processor to further: update a state of the finite state graph based on information received from the system.

13. The system of Claim 12, the non-transitory computer memory storing instructions that when executed by the computer processor cause the computer processor to further: update the graph of the finite state graph based on activity logs produced by the system.

14. The system of Claim 13, the non-transitory computer memory storing instructions that when executed by the computer processor cause the computer processor to further: display to a user via a user interface, one or more of the updated finite state machine graphs, each displayed updated finite state machine graph representing a cybersecurity attack model.

15. The system of Claim 14, the non-transitory computer memory storing instructions that when executed by the computer processor cause the computer processor to further: display nodes of the updated finite machine graph in a color to indicate a risk level associated with the state of the node.

16. The system of Claim 15, the non-transitory computer memory storing instructions that when executed by the computer processor cause the computer processor to further:display the color corresponding to a traffic signal, displaying the nodes as one of red, yellow and green.

17. The system of Claim 13, the non-transitory computer memory storing instructions that when executed by the computer processor cause the computer processor to further: update the finite machine graph upon receiving additional information from the system.

18. The system of Claim 12, the non-transitory computer memory storing instructions that when executed by the computer processor cause the computer processor to further: indicate a status of a cybersecurity attack vector to a user via a user interface via an updated finite state graph.

19. The system of Claim 12, the non-transitory computer memory storing instructions that when executed by the computer processor cause the computer processor to further: periodically receive log and alert information from the system; and update one or more finite state graphs based on the received information.

20. The system of Claim 11 , the non-transitory computer memory storing instructions that when executed by the computer processor cause the computer processor to further: for each tactic in the textual CISA alert, create a node in the finite state graph; andfor each technique in the textual CISA alert, create an edge connecting two nodes in the finite state graph.

Images