Correlating Network Event Anomalies Using Active And Passive External Reconnaissance To Identify Attack Information

What is this patent about?

’628 is related to the field of cybersecurity and threat analytics, specifically addressing the problem of identifying attack pathways and points of origin within a network. Existing cybersecurity rating methods often fail to adequately profile and rate organizations because they don't incorporate sufficient information about the complex relationships between network components and other organizational assets. The patent aims to improve threat detection and mitigation by correlating anomalous network events and identifying attack patterns.

The underlying idea behind ’628 is to create a cyber-physical graph that models an organization's entire infrastructure, including network devices, users, resources, and their relationships. By analyzing this graph in conjunction with real-time network event data, the system can identify anomalous events, trace their connections to other network resources, and construct a behavior graph that reveals potential attack pathways. This allows for determining the origin and progression of an attack.

The claims of ’628 focus on a computer system that stores a representation of a directed graph in hardware memory. This graph represents entities (accounts, resources) and their relationships. The system receives streaming data about network events, identifies new entities and relationships not already in the graph, and modifies the graph accordingly. For anomalous events, the system performs correlations to identify related nodes and generates a second graph representing event flows that could be involved in a cybersecurity attack, ultimately generating a report with information about these flows.

In practice, the system continuously monitors network traffic and system logs, feeding this data into the cyber-physical graph. When an unusual event occurs, such as a user accessing a restricted file or a device communicating with a known malicious IP address, the system flags it as an anomaly. It then uses the graph to trace the connections between the anomalous event and other network resources, identifying potential attack pathways. This allows security personnel to quickly understand the scope and impact of the attack.

The key differentiation from prior approaches lies in the use of a comprehensive cyber-physical graph and real-time data analysis to identify attack pathways. Instead of simply detecting individual anomalies, the system correlates these events to reveal the underlying attack patterns and points of origin. This proactive approach enables more effective threat mitigation and remediation by addressing the root causes of vulnerabilities rather than just the symptoms of an attack. The system also incorporates external threat intelligence feeds and machine learning to continuously improve its ability to detect and predict attacks.