System and methods thereof for monitoring and preventing security incidents in a computerized environment

A system detects and handles security incidents in a computerized environment. The system collects metadata respective of one or more user devices communicatively coupled in the computerized environment. Respective of the collected metadata, the system generates expected behavior patterns of the user devices within the computerized environment. The system continuously monitors the actual behavior of the user devices. Upon detection of deviations from the expected behavior patterns, the system sends a terminable agent to the user device in which the deviation was detected. The system then receives from the terminable agent metadata respective of the deviation. Upon determination that the deviation is a security incident respective of the metadata, the system configures the terminable agent to initiate actions respective thereto. The type of actions required is determined respective of the metadata received from the terminable agent. Upon removal of the security incident, the agent may be terminated.

BACKGROUND

Technical Field

One or more exemplary embodiments generally relate to data security, and more specifically, to a system and methods for detection and prevention of security incidents in a computerized environment.

Description of the Related Art

Nowadays, as organizations and enterprises increase in size, they are increasingly more susceptible to malicious attack.

In order to identify such attacks, a number of different anti-virus applications are currently available. These applications must be deployed into a computerized environment and are supposed to terminate malicious activity within the network. These applications are typically used for managing the data and communication. Other solutions are commonly known anti-virus solutions that detects and remove known viruses by identifying “signatures” including characteristic behaviors of viruses. Other solutions known in the art only provide threat detection and do not provide any mitigation process. The majority of these solutions rely upon a basic engine that searches suspect files for the presence of predetermined virus signatures.

SUMMARY

All these related art solutions for preventing security incidents have not been sufficiently effective. In the view of the shortcoming of related art approaches it would be advantageous to provide an efficient solution for detecting and preventing security incidents in a computerized environment. It would be further advantageous if such a solution can be adaptive respective of the type of the computerized environment.

Exemplary embodiments overcome the above disadvantages and other disadvantages not described above. Also, an exemplary embodiment is not required to overcome the disadvantages described above, and an exemplary embodiment of the present inventive concept may not overcome any of the problems described above.

The foregoing and/or exemplary embodiments may be achieved by a method of generating a response to a security incident occurring in a computerized environment that comprises one or more user devices, the method including generating, by a computerized device, at least one terminable agent upon detection of at least one deviation from an expected behavior of at least one of the one or more user devices; sending, by the computerized device, the at least one terminable agent to the at least one user device in which the at least one deviation is detected; configuring the at least one terminable agent to send metadata respective of the at least one deviation; determining, by the computerized device, whether the at least one deviation is a security incident respective of the metadata; configuring, by the computerized device, the at least one terminable agent to initiate at least one action upon determination that the at least one deviation is a security incident; and terminating, by the computerized device, the at least one terminable agent upon determination that the security incident is cleared.

The method may further include detecting the at least one deviation from the expected behavior of at least one of the one or more user devices, the detecting including receiving, by the computerized device, at least one notification of the at least one deviation from the expected behavior of at least one of the one or more user devices.

The method may further include detecting the at least one deviation from the expected behavior of at least one of the one or more user devices, the detecting including collecting, by the computerized device, metadata respective of behavior patterns of the one or more user devices; and generating, by the computerized device, expected behavior patterns of each of the one or more user devices.

The configuring the at least one terminable agent to initiate at least one action upon determination that the at least one deviation is a security incident includes configuring the at least one terminable agent to perform at least one of: terminating a process in the at least one user device, removing content from the at least one user device, redirecting network connectivity, generating a firewall protection, blocking a host connection, and executing a cleaning and detection tool.

The foregoing and/or exemplary embodiments may be achieved by an apparatus for generating a response to a security incident occurring in a computerized environment that comprises one or more user devices, the system including one or more processors and memory storing executable instructions that, when executed by the one or more processors, causes the one or more processors to: generate at least one terminable agent upon detection of at least one deviation from an expected behavior of at least one of the one or more user devices; send the at least one terminable agent to the at least one user device in which the at least one deviation is detected; configure the at least one terminable agent to send metadata respective of the at least one deviation; determine whether the at least one deviation is a security incident respective of the metadata; configure the at least one terminable agent to initiate at least one action upon determination that the at least one deviation is a security incident; and terminate the terminable agent upon determination that the security incident is cleared.

The memory may store further executable instructions that, when executed by the one or more processors, causes the one or more processors to: detect the at least one deviation from the expected behavior of at least one of the one or more user devices by receiving at least one notification of the at least one deviation from the expected behavior of at least one of the one or more user devices.

The memory may store further executable instructions that, when executed by the one or more processors, causes the one or more processors to: detect the at least one deviation from the expected behavior of at least one of the one or more user devices by collecting, by the computerized device, metadata respective of behavior patterns of the one or more user devices; and generating, by the computerized device, expected behavior patterns of each of the one or more user devices.

The foregoing and/or exemplary embodiments may be achieved by a non-transitory computer readable storage medium storing a program for executing a method of generating a response to a security incident occurring in a computerized environment that comprises one or more user devices, the method including: generating, by a computerized device, at least one terminable agent upon detection of at least one deviation from an expected behavior of at least one of the one or more user devices; sending, by the computerized device, the at least one terminable agent to the at least one user device in which the at least one deviation is detected; configuring the at least one terminable agent to send metadata respective of the at least one deviation; determining, by the computerized device, whether the at least one deviation is a security incident respective of the metadata; configuring, by the computerized device, the at least one terminable agent to initiate at least one action upon determination that the at least one deviation is a security incident; and terminating, by the computerized device, the at least one terminable agent upon determination that the security incident is cleared.

DETAILED DESCRIPTION OF THE INVENTION

In a non-limiting embodiment, a system detects and handles security incidents in a computerized environment. The system collects metadata respective of one or more user devices communicatively coupled in the computerized environment. Respective of the collected metadata, the system generates expected behavior patterns of the user devices within the computerized environment. The system continuously monitors the actual behavior of the user devices.

Upon detection of deviations from the expected behavior patterns, the system sends a terminable agent to the user device in which the deviation was detected. The system then receives from the terminable agent metadata respective of the deviation. Upon determination that the deviation is a security incident respective of the metadata the system configures the terminable agent to initiate actions respective thereto. The type of actions required is determined respective of the metadata received from the terminable agent. Upon removal of the security incident, the agent may be terminated.

FIG. 1depicts an exemplary and non-limiting block diagram used to describe the operation of the system100according to an exemplary embodiment. One or more user devices (UD)110-1through110-N (collectively referred hereinafter as user devices110or individually as a user device110, merely for simplicity purposes), where N is an integer equal to or greater than1, are communicatively connected to a network120. The one or more user devices110-1through110-N can be, but are not limited to smart phone, mobile phones, laptops, tablet computers, wearable computing devices, personal computers (PCs), smart televisions and the like. The network120may comprise the likes of busses, local area network (LAN), wide area network (WAN), metro area network (MAN), the worldwide web (WWW), the Internet, as well as a variety of other communication networks, whether wired or wireless, and in any combination, that enable the transfer of data between the different elements of the system100.

A server130is further connected to the network120. The server130is configured to collect metadata respective of the behavior patterns of the user devices110. The metadata may include, for example, but not by way of limitation, bandwidth consumption of the one or more user devices110, data related to uses of the user devices110, content stored within a memory of the user devices110, data related to the operation and/or processing of the user devices110, data related to users of the user devices110, data related to an operating systems of the user devices, user permissions, threat information, etc. Metadata related to content may be related, for example, to the operation of application software programs executed on the user devices110. Respective of the collected metadata, the server130is configured to generate expected behavior patterns for the user devices110. The expected behavior patterns further include the expected behavior of the user devices110within the network120as well as the behavior of the user devices and the network120as part of a computerized environment of, for example, an enterprise. The server130then monitors the behavior of the user devices110. Upon determination of a deviation from the expected behavior pattern of at least one user device110, the server130is configured to generate a terminable agent (TA)115respective thereto. A deviation may be, for example, but not by way of limitation, a suspicious file installed on a user device110, a suspicious activity within the network120, abnormal network consumption, abnormal memory activity, unauthorized access to content, etc.

According to another exemplary embodiment, the server130receives one or more notifications respective a deviation from a behavior pattern, from, for example, a detection system (not shown) communicatively coupled to the server130over the network120. The detection system may be, for example, an intrusion prevention system (IPS), a data leakage prevention (DLP) system, etc.

The TA115is then sent to the source in which the deviation identified, for example, the user device110-N. According to another exemplary embodiment, the TA115may be sent to a source from which additional metadata is required in order to generate an expected behavior pattern and/or identify deviation therefrom. The TA115is self-contained, thereby does not require configurations from the designated user device110-N. According to one exemplary embodiment, the TA115works in the background of the user device110-N and is therefore hidden to users of the user device110-N. The TA115is configured by the server130to send metadata respective of the deviation. The metadata received by the TA115respective of the deviation enables the server130to determine whether the deviation is a security incident. Upon determination that the deviation is a security incident, the server130configures the TA115to initiate one or more actions respective thereto. The actions are determined by the server130respective of the type of the security incident. The actions may also be determined by the server130respective of the type of the network120and the type of the security incident. The actions may be, for example, termination of a process, removal of content, redirection of network connectivity, generation of an ad-hoc firewall protection, block of host connection, execution of one or more cleaning and detection tools, etc.

Upon completion of the actions the TA115is terminated by the server130. According to another exemplary embodiment, the TA115is configured by the server130to continuously send additional metadata respective of the security incident and only upon determination that the security incident is terminated the server130terminates the TA115. According to one exemplary embodiment, the system100further comprises at least one database140. The database140is configured to store, for example, metadata collected from the user devices110, expected and actual behavior patterns, metadata received from the TA115, etc.

FIG. 2is an exemplary and non-limiting flowchart200describing a method for monitoring and preventing security incidents in a computerized environment according to an embodiment. The operation starts when metadata respective of behavior patterns of one or more user devices110is collected (S205). One or more expected behavior patterns are generated respective of the metadata (S210). It is checked whether a deviation from the one or more expected behavior patterns is detected in at least one user device of the user devices110(S215) and if so, execution continues with S220; otherwise, execution continues with S205. According to another exemplary embodiment (not shown), the operation starts when a notification of a deviation from common/expected behavior is received from, for example, an external detection system and the operation continues with S220. In S220, at least one terminable agent such as the TA115is generated respective of the deviation. In S225, the TA115is sent to a source in which the deviation is detected, for example, the user device110-N. In S230, the TA115is configured to send metadata respective of the deviation. In S235, it is checked whether the deviation is a security incident and if so, execution continues with S240; otherwise, execution continues with S245. In S240, the TA115is configured to initiate one or more actions respective of the security incident. In S245, the TA115is terminated. In S250, it is checked whether to continue with the operation and if so, execution continues with S205; otherwise, execution terminates.