System and method for providing computer network security

This disclosure relates generally to computer network, and more particularly to a system and method for providing computer network security. In one embodiment, a method is provided for providing computer network security. The method comprises gathering threat information from one or more sources, deriving security intelligence based on the threat information, determining a security measure based on the security intelligence, and dynamically applying the security measure to a computer network using a set of virtual appliances and a set of virtual switches.

TECHNICAL FIELD

This disclosure relates generally to computer network, and more particularly to a system and method for providing computer network security.

BACKGROUND

Digital devices, including, for example, computers, notebook computers, laptops, tablet devices, cellular telephones, smart phones, have become ubiquitous in recent years. In an increasingly digital world, these digital devices are communicatively connected to a computer network to exchange information. Computer network security is an important aspect of the computer network and means activities designed to protect the computer network and the digital devices connected to the computer network from digital attacks and data theft. These activities protect the usability, reliability, integrity, and safety of the network and data. A network security breach has a serious impact on individual users as well as businesses.

Several techniques exist to provide computer network security. For example, currently network security is handled using expensive hardware appliances like firewalls, intrusion prevention systems, and virtual private networks (VPNs). However, these hardware appliances are typically pre-provisioned and therefore cannot be changed dynamically on the fly as required. In some instances, the software are upgraded at periodic intervals with new threat signatures whenever new threats are detected. Moreover, these hardware appliances are over-provisioned to handle the variable network traffic and load. Current techniques are therefore inefficient and limited in their ability to convert the threat information to the right security intelligence and to use the security intelligence accurately and timely. This may result in disruption of services and grave financial losses to an organization.

SUMMARY

In one embodiment, a method for providing computer network security is disclosed. In one example, the method comprises gathering threat information from one or more sources. The method further comprises deriving security intelligence based on the threat information. The method further comprises determining a security measure based on the security intelligence. The method further comprises dynamically applying the security measure to a computer network using a set of virtual appliances and a set of virtual switches.

In one embodiment, a system for providing computer network security is disclosed. In one example, the system comprises at least one processor and a memory communicatively coupled to the at least one processor. The memory stores processor-executable instructions, which, on execution, cause the processor to gather threat information from one or more sources. The processor-executable instructions, on execution, further cause the processor to derive security intelligence based on the threat information. The processor-executable instructions, on execution, further cause the processor to determine a security measure based on the security intelligence. The processor-executable instructions, on execution, further cause the processor to dynamically apply the security measure to a computer network using a set of virtual appliances and a set of virtual switches.

In one embodiment, a non-transitory computer-readable medium storing computer-executable instructions for providing computer network security is disclosed. In one example, the stored instructions, when executed by a processor, cause the processor to perform operations comprising gathering threat information from one or more sources. The operations further comprise deriving security intelligence based on the threat information. The operations further comprise determining a security measure based on the security intelligence. The operations further comprise dynamically applying the security measure to a computer network using a set of virtual appliances and a set of virtual switches.

DETAILED DESCRIPTION

Referring now toFIG. 1, an exemplary system100for providing computer network security is illustrated in accordance with some embodiments of the present disclosure. In particular, the system100implements techniques for improved detection and prevention of network security threats in a computer network by retrieving threat information from various resources, determining security threats and corresponding security measures based on the threat information using intelligent filters and analytics, and applying these security measures to the computer network using virtual appliances and virtual switches. The system100comprises threat data feeders101, a threat intelligence center102, a core security advisor103, a virtual orchestrator104, and a SON controller105.

The threat data feeders101gather threat related information from various sources. The various sources may include crowd source based public forums106, internal or external security research teams107, tool based feeds108, and so forth. In some embodiments, tool based feeds108may include, but are not limited to, SPLUNK analysis based feeds that gather information from logs created by installed programs and applications. Further, in some embodiments, tool based feeds108may include network traffic analysis from a network traffic analyzer.

The threat intelligence center102collects data from various threat data feeders101and derives security intelligence by applying intelligent filters and analytics on the threat information. The security intelligence comprises potential security threats and corresponding security measures and is passed on to the core security advisor103for adaptive threat prevention and containment.

The core security advisor103is the central controller of the entire system100. The core security advisor103receives the security intelligence from the threat intelligence center102, and dynamically applies the security measures to the computer network using relevant virtual appliances109and virtual switches110. In some embodiments, the core security advisor103maps the security intelligence to the relevant virtual appliances109that need to be deployed and to the relevant packet filters that is used to program the relevant virtual switches110. The core security advisor103then passes the mapping to the virtual orchestrator104. Further, in some embodiments, the core security advisor103may trigger an alert based on the security intelligence.

The virtual orchestrator104may be a proprietary orchestrator or one of the available orchestrator such as OpenStack™. The virtual orchestrator104includes two main modules namely a provisioning module111and a filtering module112. The provisioning module111deploys (i.e., instantiates or deletes) various virtual appliances (e.g., VA1, VA2, and VA3)109dynamically on the fly and employs service chaining to connect them as required based on the mapping. Each of the virtual appliances109is a virtual machine for performing a pre-defined task and is implemented using network function virtualization. The virtual appliances109emulate a firewall, an intrusion prevention system (IPS), a deep packet inspection (DPI), a network traffic shaper, and so forth. Further, the filtering module112uses the SDN controller105to program various virtual switches (e.g., VS1, VS2, and VS3)110using various packet filters to steer network traffic appropriately based on the mapping. Each of the virtual switches110is programmed using software defined networking.

The SDN controller comprises a North bound API module113, a controller114, and a South bound API module115. The North bound API module113uses the filters provided by the virtual orchestrator104and dynamically programs the virtual switches for steering network traffic from a source116to a destination117. The dynamic programming is performed by the South bound API module115using various South bound protocols like Open Flow, NETCONF, XMPP, and so forth.

In operation, the system100gathers threat information from various sources such as external security agencies, crowd sourcing, internal research teal tool based feeds, and so forth. The system100then converts the gathered threat information to relevant security intelligence using intelligent filters and analytics. The security intelligence identifies possible security threats and corresponding security measures. In response to the threats identified and corresponding measures, the system100dynamically deploys virtual appliances (using network functions virtualization) and programs necessary virtual switches (using software defined networking). The programmed switches re-direct suspicious traffic to a different channel where appropriate virtual appliances are deployed to take preventive action. The system100may also be configured to trigger alerts of pre-configured type upon detecting any security threats, so as to notify the user or admin.

It should be noted that the system100may be implemented in programmable hardware devices such as programmable gate arrays, programmable array logic, programmable logic devices, and so forth. Alternatively, the system100may be implemented in software for execution by various types of processors. An identified engine of executable code may, for instance, comprise one or more physical or logical blocks of computer instructions which may, for instance, be organized as an object, procedure, function, module, or other construct. Nevertheless, the executables of an identified engine need not be physically located together, but may comprise disparate instructions stored in different locations which, when joined logically together, comprise the engine and achieve the stated purpose of the engine. Indeed, an engine of executable code could be a single instruction, or many instructions, and may even be distributed over several different code segments, among different applications, and across several memory devices.

Referring now toFIG. 2, an overview of an exemplary process200for providing computer network security is depicted via a flowchart in accordance with some embodiments of the present disclosure. The process200involves the steps of retrieving threat information from various sources at step201, determining security threats and corresponding preventive measures at step202, and executing the preventive measures using virtual appliances and virtual switches at step203. Each of these steps will be described in greater detail herein below.

At step201, threat information is retrieved or gathered by the threat data feeders module from various sources such as internal or external security research teams, tool based feeds, crowd sourcing, and so forth. In some embodiments, the sources may include, but are not limited to, network monitoring specifically social network monitoring, spam traps, honeypots, link crawling for malware and exploit code, and so forth. As stated above, the information retrieved by the threat data feeders is then provided to the threat intelligence center for further processing.

At step202, the threat intelligence center creates combined and standardized threat information based on threat information retrieved from multiple sources in various formats and standards. The threat information provided to the threat intelligence center comprises information that has been analyzed and retrieved from multiple sources so as to discover insights that assists in preventing security threats. As will be appreciated by those skilled in the art, different sources provide threat information in various formats and standards. For example, SPLUNK tool based information may be in JavaScript Object Notation (JSON) format whereas crowd sourced threat information may be in key value pairs in comma-separated values (CSV) format. So each of these threat information are converted into one common standard format (e.g. XML schema) for subsequent use. The standard format describes the technical characteristics such as known threats, an attacker's methodology of attack, or other such evidence of threats.

The threat intelligence center then applies an intelligent filter, an analytics, or a reputation based heuristic on the combined and standardized threat information to derive security intelligence. In some embodiments, deriving security intelligence also includes identifying the right sources that provide the most valuable and best coverage that is contextualized to the specific vertical industry of the organization to which the technique is being applied. The analytics helps to contextualize and correlate events while the reputation based heuristics helps to rank the source of information, thereby ensuring that false or non-relevant threat information is eliminated. For example, in retail industry the kind of potential threats may be ‘denial of service’ attacks so that retail customers are not able to access the relevant stores online. Alternatively, the potential threats may be stealing some or all of confidential customer related information such as credit card information. Similarly, in healthcare industry the threat may be to steal or manipulate patient's health records. Applying analytics helps to contextualize the seriousness of any security threats. Further, threat information from a government agency may be ranked higher in reputation as compared to threat information sourced from a public forum. Such reputation based heuristics help to quickly separate the false or non-serious threats from the real and serious threats.

The threat intelligence center then determines corresponding preventive or security measures. These measures are actionable breach responses and risk mitigation strategies for each of the real threats identified. For example, the actionable response may be to ‘block all packets from a specific source or to a specific destination’, to ‘divert all packets on a specific TCP port for further analysis’, to ‘remove infected files’, to ‘rewrite affected registry keys’, and so forth.

The core security advisor receives the security measures and maps the security measure to the set of relevant virtual appliances and the set of relevant virtual switches. In some embodiments, mapping the set of relevant virtual appliances and the set of relevant virtual switches comprises generating appropriate packet filters and virtual appliances based on the security measure to be applied. The actionable breach responses are implemented in the form of packet filters with an action and virtual appliances. Packet filters are general regular expression based pattern matching filters. For example, a simple filter may be ‘any packet from a specific source address’. These are applied to the virtual switches (VS1, VS2, VS3, etc.) using standard protocols like Open Flow by the virtual orchestrator. The virtual switches apply these filters to all the packets that pass through the virtual switches and perform the given action such as block packets, divert packets, and so forth. Further, the virtual appliances are pre-configured software virtual machines for performing specific tasks and may be created dynamically on the fly. For example, a virtual appliance may be created to perform deep packet analysis.

At step203, the core security advisor dynamically applies the security measures to the computer network using relevant virtual appliances and virtual switches. The core security advisor along with the virtual orchestrator and SDN controller executes the preventive security measures in the computer network. Network function virtualization in combination with software defined networking provides the flexibility to create and deploy the required virtual appliances dynamically on the fly and program the virtual switches to apply relevant actions on the traffic that flows through them. SDN controller programs the virtual switches using the appropriate packet filters to steer suspicious and non-suspicious network traffic appropriately (e.g., non-suspicious traffic is steered away from the suspicious traffic). The virtual orchestrator deploys the relevant virtual appliances and provisions them. For example, suspicious traffic may be diverted to specialized virtual appliances (VA1, VA2, VA3, etc.) for further analysis.

As will be appreciated by one skilled in the art, a variety of processes may be employed for providing computer network security. For example, the exemplary system100may provide computer network security by the processes discussed herein. In particular, as will be appreciated by those of ordinary skill in the art, control logic and/or automated routines for performing the techniques and steps described herein may be implemented by the system100, either by hardware, software, or combinations of hardware and software. For example, suitable code may be accessed and executed by the one or more processors on the system100to perform some or all of the techniques described herein. Similarly, application specific integrated circuits (ASICs) configured to perform some or all of the processes described herein may be included in the one or more processors on the system100.

For example, referring now toFIG. 3, exemplary control logic300for providing computer network security via a system, such as system100, is depicted via a flowchart in accordance with some embodiments of the present disclosure. As illustrated in the flowchart, the control logic300includes the step of gathering threat information from one or more sources at step301, deriving security intelligence based on the threat information at step302, determining a security measure based on the security intelligence at step303, and dynamically applying the security measure to a computer network using a set of virtual appliances and a set of virtual switches at step304. In some embodiments, the control logic300further includes the step of triggering an alert based on the security intelligence.

It should be noted that each virtual appliance is a virtual machine for performing a pre-defined task and is implemented using network function virtualization. Further, each virtual appliance emulates at least one of a firewall, an intrusion prevention system (IPS), a deep packet inspection (DPI), and a network traffic shaper. Additionally, each virtual switch is programmed using software defined networking.

In some embodiments, deriving the security intelligence at step302comprises determining one or more potential security threats by applying at least one of a filter, an analytics, and a reputation based heuristic on the threat information. Additionally, in some embodiments, determining the security measure at step303comprises determining a corresponding security measure for each of the one or more potential security threats. Further, in some embodiments, dynamically applying at step304comprises mapping the security measure to the set of virtual appliances and the set of virtual switches. In some embodiments, dynamically applying at step304further comprises dynamically deploying the set of virtual appliances based on the mapping. Moreover, in some embodiments, dynamically applying at step304comprises dynamically programming the set of virtual switches using a plurality of packet filters to steer network traffic based on the mapping.

The disclosed methods and systems may be implemented on a conventional or a general-purpose computer system, such as a personal computer (PC) or server computer. Referring now toFIG. 4, a block diagram of an exemplary computer system401for implementing embodiments consistent with the present disclosure is illustrated. Variations of computer system401may be used for implementing system100for providing computer network security. Computer system401may comprise a central processing unit (“CPU” or “processor”)402. Processor402may comprise at least one data processor for executing program components for executing user- or system-generated requests. A user may include a person, a person using a device such as such as those included in this disclosure, or such a device itself. The processor may include specialized processing units such as integrated system (bus) controllers, memory management control units, floating point units, graphics processing units, digital signal processing units, etc. The processor may include a microprocessor, such as AMD Athlon, Duron or Opteron, ARM's application, embedded or secure processors, IBM PowerPC, Intel's Core, Itanium, Xeon, Celeron or other line of processors, etc. The processor402may be implemented using mainframe, distributed processor, multi-core, parallel, grid, or other architectures. Some embodiments may utilize embedded technologies like application-specific integrated circuits (ASICs), digital signal processors (DSPs), Field Programmable Gate Arrays (FPGAs), etc.

Using the I/O interface403, the computer system401may communicate with one or more I/O devices. For example, the input device404may be an antenna, keyboard, mouse, joystick, (infrared) remote control, camera, card reader, fax machine, dongle, biometric reader, microphone, touch screen, touchpad, trackball, sensor (e.g., accelerometer, light sensor, GPS, gyroscope, proximity sensor, or the like), stylus, scanner, storage device, transceiver, video device/source, visors, etc. Output device405may be a printer, fax machine, video display (e.g., cathode ray tube (CRT), liquid crystal display (LCD), light-emitting diode (LED), plasma, or the like), audio speaker, etc. In some embodiments, a transceiver406may be disposed in connection with the processor402. The transceiver may facilitate various types of wireless transmission or reception. For example, the transceiver may include an antenna operatively connected to a transceiver chip (e.g., Texas Instruments WiLink WL1283, Broadcom BCM4750IUB8, Infineon Technologies X-Gold 618-PMB9800, or the like), providing IEEE 802.11a/b/g/n, Bluetooth, FM, global positioning system (GPS), 2G/3G HSDPA/HSUPA communications, etc.

In some embodiments, the processor402may be disposed in communication with a communication network408via a network interface407. The network interface407may communicate with the communication network408. The network interface may employ connection protocols including, without limitation, direct connect, Ethernet (e.g., twisted pair 10/100/1000 Base T), transmission control protocol/internet protocol (TCP/IP), token ring, IEEE 802.11a/b/g/n/x, etc. The communication network408may include, without limitation, a direct interconnection, local area network (LAN), wide area network (WAN), wireless network (e.g., using Wireless Application Protocol), the Internet, etc. Using the network interface407and the communication network408, the computer system401may communicate with devices409,410, and411. These devices may include, without limitation, personal computer(s), server(s), fax machines, printers, scanners, various mobile devices such as cellular telephones, smartphones (e.g., Apple iPhone, Blackberry, Android-based phones, etc.), tablet computers, eBook readers (Amazon Kindle, Nook, etc.), laptop computers, notebooks, gaming consoles (Microsoft Xbox, Nintendo DS, Sony PlayStation, etc.), or the like. In some embodiments, the computer system401may itself embody one or more of these devices.

As will be appreciated by those skilled in the art, the techniques described in the various embodiments discussed above provide for efficient, cost effective, and dynamic computer network security. The techniques enable improved and proactive detection and prevention of network security threats in cost effective manner using a combination of network function virtualization, software defined networking, and advanced threat intelligence. Further, the techniques enable harnessing various advances in threat intelligence exchange from multiple reliable sources by deriving right security intelligence in real time and by timely applying the appropriate preventive measures to the computer network using the appropriate virtual appliances and virtual switches. Additionally, the techniques provide for dynamically scaling-up and scaling-down the required hardware based on the load of the network traffic. Moreover, as will be appreciated by those skilled in the art, the techniques described in the various embodiments discussed above may be deployed in a customer premise or may be provided as a service. Further, the techniques may be configured to use customer's existing threat data feeders and analytics data.