Threat detection and prevention for information systems

A device that is configured to receive user activity information that includes information about user interactions with a network device for a plurality of users. The device is further configured to input the user activity information into a first machine learning model that is configured to receive user activity information and to output a set of bad actor candidates based on the user activity information. The device is further configured to filter the user activity information based on the set of bad actor candidates. The device is further configured to input the filtered user activity information into a second machine learning model that is configured to receive the filtered user activity information and to output system exposure information that identifies network security threats. The device is further configured to identify network security actions based on the network security threats and to execute the network security actions.

TECHNICAL FIELD

The present disclosure relates generally to information security, and more specifically to thereat detection and prevention for information systems.

BACKGROUND

In a network environment, devices are in data communication with other devices that may be distributed anywhere in the world. These network environments allow data and information to be shared among devices. Some of the technical challenges that occur when data is exchanged between devices are controlling data leakage, unauthorized access to data, and preventing malicious activities. Data storing devices, such as databases and servers, are vulnerable to attacks. This vulnerability poses several network security challenges. Existing systems are typically unable to detect a network attack until after the attack has occurred. This delayed response allows a bad actor to gain access to sensitive information within the network and/or allows bad actors to perform other malicious activities such as data exfiltration or uploading malware.

SUMMARY

The system disclosed in the present application provides a technical solution to the technical problems discussed above by leveraging machine learning to identify potential bad actors before a network attack occurs. The disclosed system provides several practical applications and technical advantages which include a process for proactively identifying bad actors based on their recent behavior and interactions with various network devices. This process improves the information security of the system by allowing the system to identify user behavior that is typically associated with a bad actor before a user is able to perform an attack on the network. This means that the system is able to protect the data within the network and to prevent a bad actor from performing any malicious activities by identifying bad actors before a network attack occurs. The disclosed system also includes a process for identifying potential network security threats or vulnerabilities within the network and implementing corrective network security actions to mitigate or prevent a network attack based on the identified network security threats. This process improves the information security of the system by allowing the system to identify any vulnerabilities within the network and to implement protective measures before an attack occurs.

Improving information security for the system also improves the underlying network and the devices within the network. For example, when a data exfiltration attack occurs, there is an increase in the amount of network resources and bandwidth that are consumed which reduces the throughput of the network. By preventing data exfiltration attacks, the system is able to prevent any unnecessary increases in the amount of network resources and bandwidth that are consumed that would otherwise negatively impact the throughput of the system. As another example, when a malware attack occurs, one or more devices within the network may be taken out of service until the malware can be removed from the devices. Taking devices out of service negatively impacts the performance and throughput of the network because the network has fewer resources for processing and communicating data. By preventing malware types of attacks, the system prevents any comprised devices from being taken out of service due to an attack that would otherwise negatively impact the performance and throughput of the network.

In one embodiment, the information security system comprises a network analysis device that is configured to receive user activity information that includes information about user interactions with a network device for multiple users. The network analysis device inputs the user activity information into a first machine learning model that is configured to receive user activity information and to output a set of bad actor candidates based on the user activity information. The network analysis device then filters the user activity information based on the set of bad actor candidates. The network analysis device inputs the filtered user activity information into a second machine learning model that is configured to receive the filtered user activity information and to output system exposure information that identifies network security threats. The network analysis device then identifies network security actions based on the network security threats and executes the network security actions.

In another embodiment, the information security system comprises a network analysis device that is configured to receive user activity information from a network device. The network analysis device inputs the user activity information into a machine learning model. The machine learning model is configured to receive user activity information and to output a set of bad actor candidates based on the user activity information. The network analysis device then receives the set of bad actor candidates from the machine learning model and outputs the set of bad actor candidates.

In another embodiment, the information security system comprises a network analysis device that is configured to receive user activity information. The network analysis device receives a set of bad actor candidates that identifies one or more users. The network analysis device filters the user activity information based on the set of bad actor candidates. The network analysis device then inputs the filtered user activity information into a machine learning model. The machine learning model is configured to receive the filtered user activity information and to output system exposure information that identifies network security threats. The network analysis device identifies network security actions based on the network security threats and executes the network security actions.

Certain embodiments of the present disclosure may include some, all, or none of these advantages. These advantages and other features will be more clearly understood from the following detailed description taken in conjunction with the accompanying drawings and claims.

DETAILED DESCRIPTION

System Overview

FIG.1is a schematic diagram of an embodiment of an information security system100that is configured to provide network threat detection and prevention. The information security system100is generally configured to analyze user activity information116that is associated with a group of users to determine whether any potential bad actors are present within the group of users based on their user activity information116. This process improves the information security of the information security system100by allowing the information security system100to proactively identify user behavior that is typically associated with a bad actor before a user is able to perform an attack on the network106. The information security system100is further configured to analyze the user activity information116that is associated with any potential bad actors to determine whether any potential network security threats120are present as well as corresponding network security actions122that can be performed to mitigate or prevent an attack within the network106. This process improves the information security of the information security system100by allowing the information security system100to proactively identify any vulnerabilities within the network106and to implement protective measures before an attack occurs.

In one embodiment, the information security system100comprises a network analysis device102, a plurality of network devices104, and a plurality of user devices124that are in signal communication with each other over a network106. The network106may be any suitable type of wireless and/or wired network including, but not limited to, all or a portion of the Internet, an Intranet, a private network, a public network, a peer-to-peer network, the public switched telephone network, a cellular network, a local area network (LAN), a metropolitan area network (MAN), a personal area network (PAN), a wide area network (WAN), and a satellite network. The network106may be configured to support any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.

Network Devices

Examples of network devices104include, but are not limited to, a computer, a server, a card reader, a database, or any other suitable type of network device. A network device104is generally configured to provide access to data or resources for a plurality of users. For example, a network device104may be a server or database that is configured to send data and receive data from a user's user device124. Examples of user devices124include, but are not limited to, a smartphone, a tablet, a laptop, a computer, or any other suitable type of user device. As another example, a network device104may be a card reader that is configured to provide a user with access to a physical location (e.g. a server room or a file room). In other examples, a network device104may be any other suitable type of device that is configured to provide a user access to data or restricted information. Each network device104may be configured to communicate with one or more user devices124using any suitable type of wired or wireless communications.

Each network device104is further configured to collect user activity information116for users and to provide the user activity information116to the network analysis device102for processing. The user activity information116generally comprises information about user interactions with a network device104. Examples of the user activity information116include, but are not limited to, web proxy logs, application usage logs, computer time usage logs, performance review information, network bandwidth usage logs, physical location access logs, or any other suitable type of information about a user's interactions with a network device104. The user activity information116may also be configured to associate information about a user's interactions with a network device104with one or more unique identifiers for the user. Examples of identifiers include, but are not limited to, alphanumeric identifiers (e.g.

employee numbers), email addresses, phone numbers, Internet Protocol (IP) addresses, Media Access Control (MAC) addresses, or any other suitable type of identifier. The network devices104may be configured to communicate and send the user activity information116to the network analysis device102using Application Programming Interfaces (APIs) or any other suitable type of communication technique.

Network Analysis Device

Examples of the network analysis device102include, but are not limited to, a server, a database, a computer, or any other suitable type of network device. In one embodiment, the network analysis device102comprises a threat detection engine110and a memory112. Additional details about the hardware configuration of the network analysis device102are described inFIG.3. The memory112is configured to store machine learning models114, user activity information116, network security rules118, and/or any other suitable type of data.

The threat detection engine110is generally configured to identify potential bad actors from among a group of users based on the user activity information116that is associated with the users. The threat detection engine110is further configured to identify network security threats120based on the user activity information116, to identify network security actions122for mitigating or preventing the identified network security threats120, and to execute the identified network security actions122. An example of the threat detection engine110is described in more detail below inFIG.2.

The network security rules118are generally configured to provide a mapping between network security threats120and network security actions122. InFIG.1, the network security rules118are shown in a table data structure. In other examples, the network security rules118may be implemented using any other suitable type of data structure. The network security threats120identify types of attack that the information security system100is vulnerable to. Examples of network security threats120include, but are not limited to, data exfiltration attacks, unauthorized access attacks, malware attacks, or any other suitable type of attack. The network security actions122identify commands or instructions for mitigating a network security threat120. Examples of network security actions122include, but are not limited to, restriction access to a website, restricting or limiting outgoing data for a user, restricting access to a network device104, restricting access to a physical location, restricting access to an application, modifying network settings on a user device124, modifying permission settings for a user, or any other suitable type of action that mitigates or prevents a network security threat120.

Examples of machine learning models114include, but are not limited to, a multi-layer perceptron or any other suitable type of neural network model. In one embodiment, the machine learning models114comprise a first machine learning model114that is generally configured to receive user activity information116for a group of users as an input and to output a set of bad actor candidates based on the provided user activity information116. The set of bad actor candidates identifies one or more users from among the group of users that may be associated with malicious or suspicious activities within the network106. The first machine learning model114is trained using training data that comprises information about different types of user activity information116. During the training process, the first machine learning model114determines weights and bias values that allow the first machine learning model114to map certain types of malicious or suspicious user activity information116to users that are bad actor candidates. Through this process, the first machine learning model114is able to identify how to identify potential bad actors based on user activity information116.

The machine learning models114may further comprise a second machine learning model114that is generally configured to receive user activity information116that is associated with the set of bad actor candidates as an input and to output system exposure information based on the provided user activity information116. The system exposure information identifies one or more network security threats120that may be present based on the provided user activity information116for the set of bad actor candidates. The second machine learning model114is trained using training data that comprises information about different types of user activity information116. During the training process, the second machine learning model114determines weights and bias values that allow the second machine learning model114to map certain types of malicious or suspicious user activity information116to network security threats120. Through this process, the second machine learning model114is able to identify how to identify potential network security threats120based on user activity information116.

In some embodiments, the functionality of the first machine learning model114may be combined with the functionality of the second machine learning model114into a single machine learning model114that is configured to receive user activity information116as an input and to output a set of bad actor candidates and system exposure information based on the provided user activity information116. The threat detection engine110may be configured to train the machine learning models114using any suitable technique as would be appreciated by one of ordinary skill in the art. In some embodiments, the machine learning models114may be stored and/or trained by a device that is external from the network analysis device102.

Threat Detection and Prevention Process

FIG.2is a flowchart of an embodiment of a threat detection process200for an information security system100. The information security system100may employ process200to analyze user activity information116that is associated with a group of users to determine whether any potential bad actors are present within the group of users based on their user activity information116. This process allows the information security system100to proactively identify user behavior that is typically associated with a bad actor before a user is able to perform an attack on the network106. The information security system100may also employee process to further analyze the user activity information116that is associated with any potential bad actors to determine whether any potential network security threats120are present as well as corresponding network security actions122that can be performed to mitigate or prevent an attack within the network106. This process allows the information security system100to proactively identify any vulnerabilities within the network106and to implement protective measures before an attack occurs.

At step202, the network analysis device102obtains user activity information116for a group of users from one or more network devices104. As an example, the user activity information116may identify websites, applications, physical locations, and/or network devices104that were accessed by a user. In other examples, the user activity information116may identify an amount of outgoing data for a user, security violations that are associated with users, failed log-in attempts that were performed by a user, or any other suitable type of information that is associated with a user.

At step204, the network analysis device102inputs the user activity information into the first machine learning model114. Here, the network analysis device102inputs at least a portion of the user activity information116into the first machine learning model114. The first machine learning model114was previously trained to map certain types of malicious or suspicious user activity information116to users that are bad actor candidates.

At step206, the network analysis device102receives a set of bad actor candidates from the first machine learning model114. In response to inputting the user activity information116into the first machine learning model114, the network analysis device102obtains a set of bad actor candidates. The set of bad actor candidates identifies one or more users from among the group of users that may be associated with malicious or suspicious activities within the network106. As an example, the first machine learning model114may be trained to identify users that accessed web sites from among a list of malicious websites. In this example, the first machine learning model114may identify the users that have accessed malicious websites as bad actor candidates. As another example, the first machine learning model114may be trained to identify an average amount of outgoing data for a group of users and to identify users that exceed the average amount of data for the group of users. In this example, the first machine learning model114identifies users that are exceeding the average or typical amount of outgoing data as bad actor candidates. As another example, the first machine learning model114may be trained to identify security violations based on the user activity information116and to identify users that are associated with the security violations. In this example, the first machine learning model114identifies the users that are associated with the security violations as bad actor candidates. In other examples, the first machine learning model114may be trained to identify bad actor candidates based on any other suitable type or combination of criteria.

At step208, the network analysis device102filters the user activity information116based on the set of bad actor candidates. Here, the network analysis device102filters the user activity information116to remove user activity information116for any users that are not members of the set of bad actor candidates. By filtering the user activity information116, the network analysis device102isolates the information that is associated with the users that have been identified as a potential bad actor. The filtered user activity information116can then be used for further processing to identify any network security threats120that may be present based on the user activity information116that is associated with the bad actor candidates.

At step210, the network analysis device102inputs the filtered user activity information116into the second machine learning model114. The network analysis device102inputs the filtered user activity information116into the second machine learning model114. The second machine learning model114was previously trained to map certain types of malicious or suspicious user activity information116to network security threats120.

At step212, the network analysis device102receives system exposure information from the second machine learning model114. In response to inputting the user activity information116into the second machine learning model114, the network analysis device102obtains system exposure information. The system exposure information identifies one or more network security threats120that may be present based on the provided filtered user activity information116for the set of bad actor candidates.

At step214, the network analysis device102identifies network security actions122based on the system exposure information. The network analysis device102uses the network security rules118to identify network security actions122. For example, the network analysis device102may use the network security threats120identified in the system exposure information as a search token to identify corresponding network security actions122.

At step216, the network analysis device102executes the network security actions122. Here, the network analysis device102may send commands or instructions to a network device104and/or a user device124to modify the settings of the network device104and user device124to implement the identified network security actions122. For example, the network analysis device102may identify a website from within the filtered user activity information116and identify a user from among the bad actor candidates that accessed the website. The network analysis device102may then send commands or instructions to the user device124and/or a network device104to change network settings to restrict the user's future access to the website. In this example, the network analysis device102restricts the user from access the website to prevent the user from performing any malicious activities using the website.

As another example, the network analysis device102may send commands or instructions to a user device124and/or a network device104to modify network settings to restrict or block outgoing data for the user. In this example, the network analysis device102restrict or block outgoing data for the user to mitigate or prevent data exfiltration.

As another example, the network analysis device102may send commands or instructions to a user device124and/or a network device104to modify network settings to restrict or block access to one or more network device104for the user. In this example, the network analysis device102prevents the user from access data on the network device104or from using the network device104to perform malicious activities.

As another example, the network analysis device102may send commands or instructions to a user device124and/or a network device104to modify permission settings for the user device124that is associated with the user. In this example, the network analysis device102may modify the permission settings for the user to prevent the user from performing certain operations on their user device124such as installing new software or modifying network settings.

As another example, the network analysis device102may send commands or instructions to a user device124and/or a network device104to restrict access to a physical location for the user. For instance, the network analysis device102may send commands or instructions to a card reader to revoke a user's access to a physical location. In other examples, the network analysis device102may send commands or instructions to any other suitable type of network device104to restrict the user's ability to access a physical location.

As another example, the network analysis device102may send commands or instructions to a user device124and/or a network device104to modify settings on the user device124that is associated with the user. In this example, the network analysis device102may modify the user device124settings to restrict access to one or more applications for the user. In other examples, the network analysis device102may send commands or instructions to a user device124and/or a network device104to restrict or block access to any other suitable type of data for the user.

At step218, the network analysis device102determines whether to collect additional user activity information116for processing. In one embodiment, the network analysis device102may be configured to periodically collect additional user activity information116. For example, the network analysis device102may be configured to collect additional user activity information116every thirty minutes, every hour, every two hours, or at any other suitable time interval. In this case, the network analysis device102may remain at step218until the predetermined time interval has elapsed. In some embodiments, the network analysis device102may be configured to collect additional user activity information116on demand. In this case, the network analysis device102checks whether any commands or instructions have been received to collect additional user activity information116.

The network analysis device102returns to step202in response to determining to collect additional user activity information116. In this case, the network analysis device102returns to step202to collect additional user activity information116to process. Otherwise, the network analysis device102terminates process200.

Hardware Configuration for a Network Analysis Device

FIG.3is an embodiment of a network analysis device102of an information security system100. As an example, the network analysis device102comprises a processor302, a memory112, and a network interface304. The network analysis device102may be configured as shown or in any other suitable configuration.

Processor

The processor302comprises one or more processors operably coupled to the memory112. The processor302is any electronic circuitry including, but not limited to, state machines, one or more central processing unit (CPU) chips, logic units, cores (e.g. a multi-core processor), field-programmable gate array (FPGAs), application-specific integrated circuits (ASICs), or digital signal processors (DSPs). The processor302may be a programmable logic device, a microcontroller, a microprocessor, or any suitable combination of the preceding. The processor302is communicatively coupled to and in signal communication with the memory112and the network interface304. The one or more processors are configured to process data and may be implemented in hardware or software. For example, the processor302may be 8-bit, 16-bit, 32-bit, 64-bit, or of any other suitable architecture. The processor302may include an arithmetic logic unit (ALU) for performing arithmetic and logic operations, processor registers that supply operands to the ALU and store the results of ALU operations, and a control unit that fetches instructions from memory and executes them by directing the coordinated operations of the ALU, registers and other components.

The one or more processors are configured to implement various instructions. For example, the one or more processors are configured to execute threat detection instructions306to implement the threat detection engine110. In this way, processor302may be a special-purpose computer designed to implement the functions disclosed herein. In an embodiment, the threat detection engine110is implemented using logic units, FPGAs, ASICs, DSPs, or any other suitable hardware. The threat detection engine110is configured to operate as described inFIGS.1and2. For example, the threat detection engine110may be configured to perform the steps of process200as described inFIG.2.

Memory

The memory112is operable to store any of the information described above with respect toFIGS.1and2along with any other data, instructions, logic, rules, or code operable to implement the function(s) described herein when executed by the processor302. The memory112comprises one or more disks, tape drives, or solid-state drives, and may be used as an over-flow data storage device, to store programs when such programs are selected for execution, and to store instructions and data that are read during program execution. The memory112may be volatile or non-volatile and may comprise a read-only memory (ROM), random-access memory (RAM), ternary content-addressable memory (TCAM), dynamic random-access memory (DRAM), and static random-access memory (SRAM).

The memory112is operable to store threat detection instructions306, machine learning models114, user activity information116, network security rules118, and/or any other data or instructions. The threat detection instructions306may comprise any suitable set of instructions, logic, rules, or code operable to execute the threat detection engine110. The machine learning models114, the user activity information116, and the network security rules118are configured similar to the machine learning models114, the user activity information116, and the network security rules118described inFIGS.1-2, respectively.

Network Interface

The network interface304is configured to enable wired and/or wireless communications. The network interface304is configured to communicate data between network devices104and other devices, systems, or domains. For example, the network interface304may comprise a near-field communication (NFC) interface, a Bluetooth interface, a Zigbee interface, a Z-wave interface, a radio-frequency identification (RFID) interface, a WIFI interface, a LAN interface, a WAN interface, a PAN interface, a modem, a switch, or a router. The processor302is configured to send and receive data using the network interface304. The network interface304may be configured to use any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.