Computer security threat data collection and aggregation with user privacy protection

An endpoint computer in an enterprise network is configured to detect computer security threat events, such as presence of a computer virus. Upon detection of a threat event, the endpoint computer generates computer security threat data for the threat event. The threat data may include user identifiable data that can be used to identify a user in the enterprise network. The endpoint computer encrypts the user identifiable data prior to sending the threat data to a smart protection network or to an enterprise server where threat data from various enterprise networks are collected for analysis. The endpoint computer may also encrypt an identifier for the threat data and provide the encrypted identifier to the smart protection network and to an enterprise server in the enterprise network. The enterprise server may use the encrypted identifier to retrieve the threat data from the smart protection network to generate user-specific reports.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates generally to computer security, and more particularly but not exclusively to collection of computer security threat data.

2. Description of the Background Art

Computer security threats, such as malicious codes (e.g., computer virus, worm, spyware, Trojan, key loggers), online threats (e.g., malicious websites, phishing, spam), and network threats (e.g., unauthorized intrusion and data access, prohibited use of company-issued computers), have become more sophisticated. Consequently, computer security products have to be constantly updated just to keep pace with the ever increasing number of security threats. While some security threats are relatively benign, some are very destructive and even capable of bringing down entire networks. It is thus critical to detect and learn the behavior of emerging security threats as soon as possible, before widespread propagation over the Internet.

SUMMARY

In one embodiment, an endpoint computer in an enterprise network is configured to detect computer security threat events, such as presence of a computer virus. Upon detection of a threat event, the endpoint computer generates computer security threat data for the threat event. The threat data may include user identifiable data that can be used to identify a user in the enterprise network. The endpoint computer encrypts the user identifiable data prior to sending the threat data to a smart protection network or to an enterprise server where threat data from various enterprise networks are collected for analysis. The endpoint computer may also encrypt an identifier for the threat data and provide the encrypted identifier to the smart protection network and to an enterprise server in the enterprise network. The enterprise server may use the encrypted identifier to retrieve the threat data from the smart protection network and use the threat data to generate user-specific reports.

DETAILED DESCRIPTION

Being computer-related, it can be appreciated that some components disclosed herein may be implemented in hardware, software, or a combination of hardware and software (e.g., firmware). Software components may be in the form of computer-readable program code stored in a computer-readable storage medium, such as memory, mass storage device, or removable storage device. For example, a computer-readable storage medium may comprise computer-readable program code for performing the function of a particular component. Likewise, computer memory may be configured to include one or more components, which may be executed by a processor. Software components may be implemented in logic circuits, for example. Components may be implemented separately in multiple modules or together in a single module.

Referring now toFIG. 1, there is shown a schematic diagram of a computer100in accordance with an embodiment of the present invention. The computer100may be employed as an endpoint computer221(221inFIG. 2,221A and221B inFIG. 3), an enterprise server211, or a protection server231, which are shown inFIGS. 2 and 3. The computer100may have less or more components to meet the needs of a particular application. The computer100may include a processor101, such as those from the Intel Corporation or Advanced Micro Devices, for example. The computer100may have one or more buses103coupling its various components. The computer100may include one or more user input devices102(e.g., keyboard, mouse), one or more data storage devices106(e.g., hard drive, optical disk, USB memory), a display monitor104(e.g., LCD, flat panel monitor, CRT), a computer network interface105(e.g., network adapter, modem), and a main memory108(e.g., RAM). The computer network interface105may be coupled to a computer network109.

In the example ofFIG. 1, the main memory108includes software modules110, which may comprise computer-readable program code of an endpoint computer221, an enterprise server211, or a protection server231. The software modules110may be loaded from a data storage device106to the main memory108for execution by the processor101.

FIG. 2schematically shows a system for collecting and aggregating computer security threat data in accordance with an embodiment of the present invention. In the example ofFIG. 2, the system includes a plurality of enterprise networks210and one or more smart protection networks230. The enterprise networks210and a smart protection network230may comprise separate, unrelated computer networks that have access to the Internet.

The enterprise networks210may comprise separate computer networks belonging to different and unrelated entities (e.g., corporation, government, small business). The enterprise networks210may also belong to the same entity. For example, each of the enterprise networks210may be a branch office or division of the same company. Regardless, the enterprise networks210are shown as separate networks inFIG. 2to emphasize that each performs its own computer security functions and does not share computer security threat data with other enterprise networks, which is typically the case when the enterprise networks210belong to unrelated entities.

In the example ofFIG. 2, an enterprise network210comprises an enterprise server211and a plurality of endpoint computers221. An endpoint computer221may comprise a node of the enterprise network210where a computer security function is performed. For example, an endpoint computer221may comprise a computer security appliance, a gateway computer, a user client computer (e.g., desktop laptop), etc. An endpoint computer221may include a security module223. A security module223may comprise computer-readable program code for performing antivirus, anti-spam, online protection, and/or other computer security function provided by commercially available computer security products, such as those available from Trend Micro Inc. For example, the security module223may scan files in or passing through the endpoint computer221for viruses. As another example, the security module223may monitor websites visited by the user of the endpoint computer221and check the websites for malicious or inappropriate content, or violation of company policy (e.g., access of pornography websites using company computer during work hours). Yet another example, the security module223may filter spam emails received in the endpoint computer221. As will be more apparent below, the endpoint computer221is configured to detect and report to the smart protection network230computer security threat events, such as a computer virus infected file, access of prohibited or malicious website, etc., detected by the security module223.

An enterprise server211may comprise a server computer configured to maintain enterprise-related data in an enterprise data store212. The enterprise data store212may comprise a commercially available database storing, among other information, computer security threat data detected by an endpoint computer221.

Computer security threat data may comprise information about computer security threat events. Computer security threat data may include the name of the endpoint computer221, the assigned user of the endpoint computer221, the IP address of the endpoint computer221, and other data relating to the computer security threat event, such as a file or information about a file infected with a virus, the URL (uniform resource locator) of a website accessed by or through the endpoint computer221, a spam email received in the endpoint computer221, firewall and network access logs to and from the endpoint computer221, and suspicious data content in files and emails transferred to and from the endpoint computer221.

Each computer security threat data may have an associated identifier, such as a globally unique identifier (GUID). The GUID of the threat data may be assigned and provided by the endpoint computer221that detected the computer security threat event. The GUID of a threat data may include in part a common identifier of endpoint computers belonging to the same enterprise. The enterprise server211and the endpoint computer221may communicate over a local area network (LAN) within the enterprise network210.

The smart protection network230may comprise a computer network for collecting and aggregating computer security threat data received from the enterprise networks210. In the example ofFIG. 2, the smart protection network230comprises one or more protection servers231. A protection server231may comprise a server computer with a global data store232. The global data store232may comprise a commercially available database containing security threat data collected from endpoint computers221of various subscribing enterprise networks210.

The smart protection network230advantageously collects computer security threat data from enterprise networks210to allow for detection and analysis of emerging computer security threats. In one embodiment, the protection server231may be configured to receive computer security threat data from endpoint computers221of various enterprise networks210, store the computer security threat data in the global data store232, and aggregate the collected computer security threat data to detect an emerging computer security threat. As a particular example, the protection server231may receive threat data regarding virus infected files from endpoint computers221of different enterprise networks210. The antivirus researchers operating the smart protection network230may aggregate the threat data and identify files that are infected by the same computer virus within a particular time frame, and conclude that that virus is propagating over the Internet (since the virus is found in different enterprise networks210). That is, the aggregated threat data may identify a common computer security threat, such as a particular virus, in different enterprise networks210. The antivirus researchers or threat correlation algorithms may generate an antidote to the computer virus and distribute the antidote to subscribing enterprise networks210, including those not yet infected. The antivirus researchers or automated mechanisms may also alert administrators of the enterprise networks210, allowing for increased security (e.g., limit or prohibit some network access during the virus outbreak) in their respective networks. This helps minimize damage to infected enterprise networks210, but more importantly allows for timely securing of enterprise networks210yet to be infected. Such early detection and warning of potential computer virus outbreaks would be relatively difficult to accomplish by looking at computer security threat events in isolation within individual enterprise networks210.

FIG. 3shows a flow diagram illustrating collection of computer security threat data in accordance with an embodiment of the present invention. In practice, the smart protection network230communicates with all subscribing enterprise networks210. InFIG. 3, only one enterprise network210is shown as communicating with the smart protection network230for clarity of illustration. In the example ofFIG. 3, the endpoint computer221is shown in two possible locations: one labeled as221A inside the enterprise network210, and another labeled as221B outside the boundaries of the enterprise network210(e.g., on the Internet) and may not have direct connection to the enterprise network210.

The endpoint computer221, whether inside or outside the enterprise network210, detects a computer security threat event using the security module223. The endpoint computer221is configured to generate computer security threat data (“threat data”) for each computer security threat event (“threat event”). The endpoint computer221assigns an identifier in the form of a GUID to each computer security threat data for subsequent retrieval and analysis. In one embodiment, the GUID is configured to identify not just the threat data but also the particular enterprise network210where the threat event was detected.

In one embodiment, the endpoint computer221is configured to separate the threat data into two parts: user identifiable data and non-user identifiable data. The user identifiable data comprise threat data that can be used to identify a user in the enterprise network210. Examples of user identifiable data include the name of the user of the endpoint computer221, the IP address of the endpoint computer221, email addresses, access authentication information, and email/file content. Non-user identifiable data comprise threat data that cannot be used to identify a user of the endpoint computer221. Examples of non-user identifiable data include the URL or domain name of a malicious website visited by the user, copies of virus-infected files, network access logs, common email spam content, malware behavior logs, malware file parameters (paths, registry, name, size, etc), and malware correlation summary.

In one embodiment, the endpoint computer221is configured to encrypt user identifiable data of the threat data. The endpoint computer221may also be configured to encrypt the GUID of the threat data. The encryption of the GUID prevents identification of the enterprise associated with the threat data. Any suitable encryption/decryption algorithm may be employed without detracting from the merits of the present invention. In one embodiment, the key to decrypt the encrypted user-identifiable data is only available within the enterprise network210where the threat data originated. For example, the encrypted user identifiable data may only be decrypted by the enterprise server211in the same enterprise network210as the endpoint computer221. The definition of enterprise network covers the constant changing enterprise network boundaries which can be extended with secure networking infrastructure such as VPNs. In this definition, enterprise network can mean any secured enterprise endpoint machine where the decryption keys for the encrypted user identifiable data reside. User identifiable data encryption prevents identification of the user from outside the enterprise network210, alleviating privacy concerns. Addressing privacy concerns is particularly important in this case because the global data store232where the threat data will be maintained may include threat data from various, separately owned and operated enterprise networks210. The non-user identifiable data are preferably not encrypted to allow antivirus researchers operating the smart protection network230to readily analyze the non-user identifiable data and aggregate them with non-user identifiable data from other enterprise networks210.

In the example ofFIG. 3, the endpoint computer221outside the enterprise network210(see221B) sends the threat data and encrypted GUID to the protection server231of the smart protection network230(arrow301). The encrypted GUID is associated with an enterprise and can be retrieved from the enterprise server211using common authentication mechanisms. The threat data may include the encrypted user-identifiable data and the unencrypted non-user identifiable data. The endpoint computer221may forward the threat data to the enterprise server211(arrow305) when it is possible to do so (e.g., when the endpoint computer221logs onto the enterprise network210). The protection server231stores the threat data and associated encrypted GUID in the global data store232. Although the protection server231cannot readily decrypt the encrypted user identifiable data, storage of the encrypted user-identifiable data in the global data store232facilitates central storage. This implementation is useful in both the migration of data and in supporting mobile devices which may roam outside of enterprise network210boundaries but still have connection to the Internet and, through the Internet, access the smart protection network230. When the endpoint computer221is outside of the enterprise network210boundaries, all threat data can be sent to the protection server231of the smart protection network230. The enterprise server211can retrieve threat data via requesting threat data associated the encrypted GUID which is in turn associated with the enterprise (arrow303).

When the end point computer221is inside the boundaries of the enterprise network210(see221A), it forwards threat data to the enterprise server211(arrow302). The enterprise server211may analyze and filter the threat data to forward to the smart protection network230(arrow303) for reporting, analysis, or other purpose. In the example ofFIG. 3, the enterprise server211may also send a request for the threat data to the smart protection network230(arrow303). The request may include a reference matching the encrypted GUID of the requested threat data. The protection server231receives the request and queries the global data store232using the reference to the encrypted GUID. To facilitate retrieval, the encrypted GUID or the request itself may include an indicator that the request is for threat data from a particular enterprise network210. The protection server231retrieves the requested threat data from the global data store232, and forwards the requested threat data to the enterprise network210(arrow304). In the enterprise network210, the enterprise server211receives the threat data and stores the threat data in the local enterprise data store212. The enterprise server211may decrypt the encrypted user identifiable data prior to storage in the enterprise data store212. The threat data in the enterprise data store212may be employed for a variety of purposes, including for generation of user-specific reports. For example, the enterprise server211may be configured to examine threat data from the user of the endpoint computer221to determine if the user has been visiting inappropriate or company-prohibited websites using the endpoint computer221.

As can be appreciated from the foregoing, embodiments of the present invention allow for threat data collection and aggregation from separate enterprise networks210while maintaining privacy protection for both the enterprise and the users within individual enterprise networks210. This advantageously allows a third party computer security provider to collect and aggregate threat data from separate and unrelated companies, allowing for timely detection of emerging computer security threats not otherwise readily detectable from a computer network of a single company.

FIG. 4shows a flow diagram of a method400of collecting and aggregating computer security threat data in accordance with an embodiment of the present invention. The method400is explained using the components shown inFIG. 2for illustration purposes only. Other components may also be used without detracting from the merits of the present invention. As a particular example, one or more steps of the method400may be performed by computer-readable program code executed by a processor in the memory of an endpoint computer, enterprise server, or protection server as applicable.

In the method400, an endpoint computer in an enterprise network detects a computer security threat event (step401). The endpoint computer generates threat data and associated identifier, such as a GUID, for the threat event and forwards them to a protection server of a smart protection network (step402) directly or by way of an enterprise server in the same enterprise network as the endpoint computer. The threat data may have user identifiable data and non-user identifiable data. The user identifiable data and the identifier may be encrypted prior to forwarding the threat data to the protection server.

In the smart protection network, the protection server, which receives the threat data and the encrypted identifier, stores the threat data and the encrypted identifier in a global correlation data store (step403) along with threat data and encrypted identifiers from other enterprise networks. The protection server may be used to aggregate threat data from various enterprise networks to detect and analyze emerging computer security threats (step404).

In the enterprise network, the enterprise server may use a reference to the encrypted identifier to retrieve the threat data from the smart protection network (step405). The enterprise server may provide the encrypted identifier to the protection server, which matches the encrypted identifier to the threat data collected from the endpoint computer in step402. The protection server retrieves the threat data and forwards the threat data to the enterprise server. The enterprise server may be used to generate user-specific reports based on the threat data (step406). For example, the enterprise server may be configured to generate a report listing the threat events that occurred in the endpoint computer. The report may indicate the websites visited by the user to whom the endpoint computer is assigned, infected computer files in the endpoint computer, emails received by the user in the endpoint computer, and so on.

Methods and apparatus for collecting and aggregating computer security threat data have been disclosed. While specific embodiments of the present invention have been provided, it is to be understood that these embodiments are for illustration purposes and not limiting. Many additional embodiments will be apparent to persons of ordinary skill in the art reading this disclosure.