Remediating false positives of intrusion detection systems with guest introspection

The disclosure provides an approach for remediating false positives for a network security monitoring component. Embodiments include receiving an alert related to network security for a virtual computing instance (VCI). Embodiments include collecting, in response to receiving the alert, context information from the VCI. Embodiments include providing a notification to a management plane based on the alert and the context information. Embodiments include receiving, from the management plane, in response to the notification, an indication of whether the alert is a false positive. Embodiments include training a model based on the alert, the context information, and the indication to determine whether a given alert is a false positive.

BACKGROUND

Software defined networking (SDN) comprises a plurality of hosts in communication over a physical network infrastructure, each host having one or more virtualized endpoints such as virtual machines (VMs), containers, or other virtual computing instances (VCIs) that are connected to logical overlay networks that may span multiple hosts and are decoupled from the underlying physical network infrastructure. Though certain aspects are discussed herein with respect to VMs, it should be noted that they may similarly be applicable to other suitable VCIs.

For example, any arbitrary set of VMs in a data center may be placed in communication across a logical Layer 2 network by connecting them to a logical switch. Each logical switch corresponds to a virtual network identifier (VNI), meaning each logical Layer 2 network can be identified by a VNI. The logical switch is collectively implemented by at least one virtual switch on each host that has a VM connected to the logical switch. The virtual switch on each host operates as a managed edge switch implemented in software by the hypervisor on each host. Forwarding tables at the virtual switches instruct the host to encapsulate packets, using a virtual tunnel endpoint (VTEP) for communication from a participating VM to another VM on the logical network but on a different (destination) host. The original packet from the VM is encapsulated at the VTEP with an outer IP header addressed to the destination host using a mapping of VM IP addresses to host IP addresses. At the destination host, a second VTEP decapsulates the packet and then directs the packet to the destination VM. Logical routers extend the logical network across subnets or other network boundaries using IP routing in the logical domain. The logical router is collectively implemented by at least one virtual router on each host or a subset of hosts. Each virtual router operates as a router implemented in software by the hypervisor on the hosts.

SDN generally involves the use of a management plane (MP) and a control plane (CP). The management plane is concerned with receiving network configuration input from an administrator or orchestration automation and generating desired state data that specifies how the logical network should be implemented in the physical infrastructure. The management plane may have access to a database application for storing the network configuration input. The control plane is concerned with determining the logical overlay network topology and maintaining information about network entities such as logical switches, logical routers, endpoints, etc. The logical topology information specifying the desired state of the network is translated by the control plane into network configuration data that is then communicated to network elements of each host. The network configuration data, for example, includes forwarding table entries to populate forwarding tables at virtual switch(es) provided by the hypervisor (i.e., virtualization software) deployed on each host. An example control plane logical network controller is described in U.S. Pat. No. 9,525,647 entitled “Network Control Apparatus and Method for Creating and Modifying Logical Switching Elements,” which is fully incorporated herein by reference.

The rapid growth of network virtualization has led to an increase in large scale SDN data centers. The scale of such data centers may be very large, often including hundreds of servers with each server hosting hundreds of VCIs. With such scale comes a need to be able to operate such topologies securely.

A security monitoring component, such as an intrusion detection system (IDS), in a data center monitors network traffic to identify potential security threats, and raises an alarm when a potential threat is detected. However, because a security monitoring component may base its determinations on limited data, false positives may sometimes be generated. False positives can result in wasted resources, incorrect security determinations, and the like. As such, there is a need in the art for techniques to remediate false positives for security monitoring systems.

SUMMARY

Embodiments provide a method of remediating false positives for a network security monitoring component. Embodiments include receiving an alert related to network security for a virtual computing instance (VCI). Embodiments further include collecting, in response to receiving the alert, context information from the VCI. Embodiments further include providing a notification to a management plane based on the alert and the context information. Embodiments further include receiving, from the management plane, in response to the notification, an indication of whether the alert is a false positive. Embodiments further include training a model based on the alert, the context information, and the indication to determine whether a given alert is a false positive.

Further embodiments include a non-transitory computer-readable storage medium storing instructions that, when executed by a computer system, cause the computer system to perform the method set forth above, and a computer system programmed to carry out the method set forth above.

DETAILED DESCRIPTION

The present disclosure provides an approach for remediating false positives of a security component, such as an intrusion detection system (IDS) in a network. In certain embodiments, an IDS analyzes network traffic in a data center in order to detect potential security threats. For example, the IDS may compare packets to signatures associated with threats. A signature generally defines a pattern associated with a known security threat. For example, a signature may define a behavior pattern (e.g., a certain network connection, a certain process execution, an anomalous pattern of resource usage, or the like) or certain data (e.g., a particular series of bytes in network traffic) known to be associated with a malicious attack. When the IDS detects a potential security threat, it may generate an alert, which may cause action to be taken to defend and protect against the threat. However, it may not be possible to maintain specific signatures for all potential threats due to performance concerns and practical limitations, and so generic signatures may sometimes be used. As a result, the IDS may sometimes generate alerts that are false positives due to legitimate packets matching generic signatures that are overly broad. Embodiments of the present disclosure provide techniques for detecting and remediating false positives from the IDS through the use of machine learning concepts.

In some embodiments, a machine learning (ML) engine trains a model to detect false positives based on features of alerts. In order to train the model, the ML engine gathers training data during a learning phase. For example, during the learning phase, alerts may be provided to the management plane for review by a user, such as a network administrator. Context information may be gathered for each alert and provided with the alert to the management plane so that the user is able to make an informed decision regarding whether the alert is a false positive. In some embodiments, an event and correlation engine registers with a thin agent on a VCI to collect context information for each alert related to the VCI, and provides the context information along with the alert to the management plane. The context information may include, for example, file events, application events, network events, user and protocol information, and the like.

The ML engine receives indications from the management plane based on user feedback indicating whether each alert is a false positive. As explained in more detail below, the ML engine then uses these indications to generate labeled training data for the model. For example, a training data instance may include features of a given alert (e.g., derived from the signature that triggered the given alert, as well as from the context information for the given alert) and a label indicating whether the given alert is a false positive based on the user feedback. The ML engine uses the labeled training data to train the model, as described in more detail below, such as using supervised or unsupervised machine learning techniques.

Once trained, the model is used to detect false positives from the IDS. In some embodiments, when an alert is received, context information is collected for the alert, and then input is provided to the trained model based on the alert and the context information, as described in more detail below. The model then outputs an indication of whether the alert is a false positive. If the alert is a false positive, the alert may be discarded and/or a notification may be provided to one or more entities (e.g., the management plane) indicating that the alert is a false positive. If the alert is not a false positive, then actions may be taken to address the potential security threat. For example, the alert may be provided the management plane and/or one or more security components (e.g., a firewall) so that the potential security threat may be addressed.

FIG. 1is a block diagram depicting physical and virtual components of a networking environment100, in which one or more embodiments of the present disclosure may be utilized.

Networking environment100includes a data center130connected to network110. Network110is generally representative of a network of computing entities such as a local area network (“LAN”) or a wide area network (“WAN”), a network of networks, such as the Internet, or any connection over which data may be transmitted.

Data center130generally represents a set of networked computing entities, and may comprise a logical overlay network. Data center130includes host(s)105, a gateway134, a data network132, which may be a Layer 3 network, and a management network126. Data network132and management network126may be separate physical networks or different virtual local area networks (VLANs) on the same physical network.

Each of hosts105may be constructed on a server grade hardware platform106, such as an x86 architecture platform. For example, hosts105may be geographically co-located servers on the same rack or on different racks. Host105is configured to provide a virtualization layer, also referred to as a hypervisor116, that abstracts processor, memory, storage, and networking resources of hardware platform106into multiple virtual computing instances (VCIs)1351to135N(collectively referred to as VCIs135and individually referred to as VCI135) that run concurrently on the same host. VCIs135may, for example, be virtual machines (VMs), virtual appliances, containers, and/or the like. Hypervisor116may run in conjunction with an operating system (not shown) in host105. In some embodiments, hypervisor116can be installed as system level software directly on hardware platform106of host105(often referred to as “bare metal” installation) and be conceptually interposed between the physical hardware and the guest operating systems executing in the virtual machines. In some implementations, hypervisor116may comprise system level software as well as a “Domain 0” or “Root Partition” virtual machine (not shown) which is a privileged machine that has access to the physical hardware resources of the host. In this implementation, one or more of a virtual switch, virtual tunnel endpoint (VTEP), etc., along with hardware drivers, may reside in the privileged virtual machine. Although aspects of the disclosure are described with reference to VMs, the teachings herein also apply to other types of VCIs or data compute nodes (DCNs), such as containers, which may be referred to as Docker containers, isolated user space instances, namespace containers, etc. In certain embodiments, VCIs135may be replaced with containers that run on host105without the use of a hypervisor.

Hypervisor116includes a MUX module118, which may perform multiplexing operations with respect to VCIs135. In some embodiments, MUX module118interfaces between event and correlation engine172and thin agents on VCIs135, such as thin agent164, to provide context information from VCIs135to event and correlation engine172, as described in more detail below.

Gateway134provides VCIs135and other components in data center130with connectivity to network110, and is used to communicate with destinations (not shown) external to data center130. Gateway134may be a VCI, a physical device, or a software module running within host105.

Controller136generally represents a control plane that manages configuration of VCIs135within data center130. Controller136may be a computer program that resides and executes in a central server in data center130or, alternatively, controller136may run as a virtual appliance (e.g., a VM) in one of hosts105. Although shown as a single unit, it should be understood that controller136may be implemented as a distributed or clustered system. That is, controller136may include multiple servers or VCIs that implement controller functions. Controller136is associated with one or more virtual and/or physical CPUs (not shown). Processor(s) resources allotted or assigned to controller136may be unique to controller136, or may be shared with other components of data center130. Controller136communicates with hosts105via management network126.

Manager138generally represents a management plane comprising one or more computing devices responsible for receiving logical network configuration inputs, such as from a network administrator, defining one or more endpoints (e.g., VMs and/or containers) and the connections between the endpoints, as well as rules governing communications between various endpoints. In some embodiments, manager138communicates with hosts105via controller136, which receives and transmits data to and from hosts105via management network126. Manager138may provide an interface where a user, such as a network administrator, can review alerts with context information and provide feedback indicating whether the alerts are false positives. Manager138may also allow an administrator to define security policies and/or take other actions to protect data center130from security threats, such as blocking traffic related to alerts and removing entities (e.g., processes identified as malicious actors) from data center130.

VCI1351includes an app162, which may, in some embodiments, be a client or server application that requests and/or responds to requests for data. VCI1351further includes a thin agent164, which generally represents an in-guest agent that corresponds to a component external to VCI1351. In particular, thin agent164is an agent of MUX module118and/or event and correlation engine172. In some embodiments, thin agent164may be a driver that interacts with packet processing taking place at several layers in the networking stack of an OS. In one embodiment, thin agent164is a Microsoft® Windows® driver that uses the Windows® Filtering Platform (WFP). Thin agent164can collect information about VCI1351, such as context information related to alerts. In particular, thin agent164is configured to intercept network events (e.g., network pre-connect, connect, and disconnect events), file events (e.g., file access events), system events, process events, and the like that are generated due to calls made by applications, such as app162, running in VCI1351and deliver information (e.g., a type of the event, network addresses associated with the event, file names associated with the event, file locations associated with the event, user information associated with the event, process information associated with the event, etc.) about such events to MUX module118as further discussed herein.

In an example, an operating system running on VCI1351provides libraries that deliver such information about such events generated based on calls made by applications running on the operating system to a registered client. Accordingly, thin agent164is registered with the operating system and receives such events occurring on VCI1351from the operating system.

Thin agent164may also retrieve additional context information from VCI1351, such as application and user information. In some embodiments, a context engine (not shown) performs introspection into the guest OS running on VCI1351in order to retrieve context information. For example, the context engine may register hooks (e.g., callbacks) with one or more modules (e.g., kernel-space modules or user-space modules) in the guest OS of VCI1351in order to retrieve context information related to network events, and provides the context information to thing agent164.

It is noted that the components depicted in VCI1351may be representative of components of other VCIs135as well.

VCI1352includes event and correlation engine172. In some embodiments, event and correlation engine172registers with MUX module118to receive context information from thin agent164for alerts received from IDS182. Event and correlation engine172communicates with ML engine174to determine whether a trained model indicates that alerts are false positives. Event and correlation engine172also communicates with manager138to provide alerts and context information for review by an administrator.

VCI1352includes machine learning (ML) engine174, which trains and utilizes a model for determining whether alerts from IDS182are false positives. While ML engine174and event and correlation engine172are depicted as two separate components in a single VCI, the functionality described with respect to these components may alternatively be by a single component or by a plurality of components on one or more VCIs.

VCI1353comprises an intrusion detection system (IDS)182, which may be a virtual appliance that analyzes network traffic to identify potential security threats. In some embodiments, IDS182compares packets to signatures associated with potential security threats, and generates an alert when it detects one of the signatures in a packet.

As described in more detail below with respect toFIG. 2, event and correlation engine172may gather context information from VCIs135related to alerts from IDS182for use in determining whether the alerts are false positives, such as through interaction with ML engine174.

FIG. 2depicts a block diagram of an example call flow200between network components for remediating false positives of a security component, according to an embodiment. Call flow200includes IDS182, ML engine174, event and correlation engine172, MUX module118, thin agent164, and manager138ofFIG. 1.

At202, IDS182generates an alert that is received by ML engine174and event and correlation engine174. In an example, the alert is generated when IDS182detects a given signature in a packet sent or received by VCI1351(e.g., by app162) ofFIG. 1.

Upon receiving the alert, event and correlation engine172requests context information related to the alert, at204, from MUX module118. At206, MUX module requests the context information from thin agent164. At208, thin agent provides the context information to MUX module118, which then provides the context information to event and correlation engine172at210. The context information includes events and other information related to the alert from VCI1351ofFIG. 1.

If a model of ML engine174has already been trained, as described in more detail below with respect toFIG. 3, then event and correlation engine172provides the context information ML engine174for use in determining whether the alert is a false positive using the model. If the model has not yet been trained (e.g., during learning mode), then steps212and214are skipped, and event and correlation engine172sends the alert and the context information to manager138for feedback from an administrator. Once the model has been trained, event and correlation engine172may only send alerts that the model indicates are true positives to manager138, filtering out false positives or simply notifying manager138that the alerts are false positives.

When the model has been trained, ML engine174provides features of the alert (e.g., based on the context information) as inputs to the model and receives output from the model indicating whether the alert is a false positive. ML engine174then provides the indication to event and correlation engine172at214. If the alert is a false positive, then event and correlation engine172may drop the alert (e.g., taking no further action to address the alert) and/or may notify manager138that the alert is a false positive.

If the alert is a true positive (or if the model has not yet been trained), event and correlation engine172sends the alert and the context information to manager138at216. Manager138may display the alert and context information via an interface for review by a user, such as an administrator. The user may provide feedback indicating whether the alert is a false positive, such as based on a review of the alert and the context information. In some embodiments, a signature that triggered the alert is also included with the alert, and is reviewed by the user. In some embodiments, only a subset of the context information is displayed by manager138, as it may be impractical for the user to review a potentially very large amount of context information. For example, a predetermined subset of the context information known to be particularly useful in detecting false positives.

If the alert is a true positive, the user may take one or more preventative actions based on the alert. For example, the user may provide configuration input indicating that traffic related to the alert should be blocked or that one or more entities related to the alert should be disconnected from the network.

At218, feedback from the user is provided by manager138to ML engine174(and/or, in some embodiments, event and correlation engine172) for use in training (or re-training) the model. At220, ML engine174trains the model based on the feedback. For example, features of the alert may be associated with a label indicating whether the alert is a false positive (e.g., according to the feedback), and this labeled training data instance may be used to train the model. Accordingly, subsequent alerts with similar features may be identified by the model as false positives, and may be dealt with as such (e.g., avoiding unnecessary processing, review, and potentially incorrect security determinations based on the false positives).

FIG. 3is an illustration300of training and using a model for detecting false positives of a security component according to embodiments of the present disclosure. For example, illustration300may depict functionality of ML engine174ofFIG. 1.

Labeled training data310is used to train model320using machine learning techniques. Machine learning techniques generally involve using a set of training inputs and training outputs to build a model that will output a value in response to inputs. Inputs may be described as “features”. For example, each training data instance may include training data inputs or features (e.g., a signature, certain network events, file events, user information, process information, and the like associated with an alert) associated with a training data output or label (e.g., an indication of whether or not the alert is a false positive based on user feedback). A plurality of training data instances is used to train the model, such as by constructing a model that represents relationships between features and output values. In some embodiments, training involves providing training data inputs to the model and iteratively adjusting parameters of the model until the outputs from the model in response to the training data inputs match (or fall within a certain range of) the training data outputs associated with the training data inputs, or until a certain number of iterations have been completed without significant improvements in accuracy.

Features may be determined by extracting certain items of data from context information for an alert. For example, features extracted for an alert may include files read, files written, a user identifier and other user attributes for a user associated with a packet that triggered the alert, application information of an application associated with the packet that triggered the alert, an operating system, version information (e.g., a patch version of an application), a protocol, network events such as callbacks when connections are made or terminated (e.g., for transport control protocol (TCP), user datagram protocol (UDP), or internet control message protocol (ICMP) connections), whether traffic is inbound or outbound, and/or the like), process events (e.g., process start and stop times, process traffic information, process identifiers), and/or the like.

The trained model may be subjected to testing. Testing generally involves providing datapoints from a test dataset as inputs to the model, receiving labels as outputs, and verifying that the output labels match test labels. In some embodiments, a training data set generated based on user feedback (e.g., indicating whether given alerts are false positives) is split into training data and test data for use in the separate training and testing stages.

Model320may, for example, comprise a type of machine learning model known in the art, such as a neural network, a decision tree, a random forest, a long short term memory (LSTM) model, a gradient boosting machine, a linear regression model, or the like. In some embodiments, model320may comprise an ensemble of models that work together (e.g., on different subsets of input features or using different techniques) to determine a final output.

Once model320is trained, features330of an alert are provided as inputs to model320, which outputs an indication340of whether the alert is a true positive or a false positive. For example, the alert may be a new alert received from IDS182ofFIG. 1for which user feedback has not been received. Indication340allows action to be taken for the new alert based on whether or not it is determined to be a false positive.

In some embodiments, if multiple alerts generated by the IDS based on a particular signature are determined to be false positives, a notification may be provided to the management plane so that the administrator may investigate whether there may be a problem with the signature or another issue that should be addressed in the network. In some cases, reports of false positives may be provided to the management plane so that trends may be identified and analyzed to determine additional remedial actions that may be appropriate.

FIG. 4depicts a flow diagram of a method400related to remediating false positives of a security component according to embodiments of the present disclosure. In some embodiments, method400is performed by one or more components of host105ofFIG. 1, such as ML engine174and/or event and correlation engine172ofFIG. 1

At step402, an alert related to network security for a virtual computing instance (VCI) is received. In some embodiments, the security component is IDS182ofFIG. 1.

At step404, in response to receiving the alert, context information is collected from the VCI. For example, the context information may be collected from thin agent164via MUX module118ofFIG. 1.

At step406, a notification is provided to a management plane based on the alert and the context information. For example the alert and context information may be provided to manager138ofFIG. 1, which may display the alert and context information for review by an administrator.

At step408, an indication of whether the alert is a false positive is received from the management plane. For example, the administrator may review the alert and context information and provide feedback indicating whether the alert is a false positive, which may be provided by manager138to ML engine174ofFIG. 1.

At step410, a model is trained, based on the alert, the context information, and the indication, to determine whether a given alert is a false positive. For example, features of the alert may be generated based on the context information, and may be associated with a label indicating whether the alert is a false positive in order to generate a training data instance for use in training the model.

FIG. 5depicts a flow diagram of another method500related to remediating false positives of a security component according to embodiments of the present disclosure. In some embodiments, method500is performed by one or more components of host105ofFIG. 1, such as ML engine174and/or event and correlation engine172ofFIG. 1

At step502, an alert related to network security for a virtual computing instance (VCI) is received. In some embodiments, the security component is IDS182ofFIG. 1.

At step504, in response to receiving the alert, context information is collected from the VCI. For example, the context information may be collected from thin agent164via MUX module118ofFIG. 1.

At step506input is provided to a model based on the alert and context. For example, the model may have been trained as described above with respect toFIG. 4, and the values input to the model may be features derived from the alert and the context information.

At step508, an indication of whether the alert is a false positive is received from the model. For example, the model may output a label indicating whether the alert is a true positive or a false positive.

At step510, an action is performed based on the indication of whether the alert is a false positive. In some embodiments, if the output from the model indicates that the alert is a false positive, the action comprises one or more of: discarding the new alert; or notifying the management plane that the alert is a false positive. In certain embodiments, if the output from the model indicates that the alert is not a false positive, the action comprises notifying the management plane of the alert.