Patent ID: 12261822

DETAILED DESCRIPTION

Various embodiments will be described in detail with reference to the drawings, wherein like reference numerals represent like parts and assemblies throughout the several views. Reference to various embodiments does not limit the scope of the claims attached hereto. Additionally, any examples set forth in this specification are not intended to be limiting and merely set forth some of the many possible embodiments for the appended claims.

FIG.1is a schematic diagram illustrating an example of a network threat prediction and blocking system100. In this example, the system100includes a protected network102, a firewall device104, a threat intelligence server106, and a reputation and relationship server108. The example protected network102includes a router110, a protected network communication system112, and protected devices114(e.g., computing devices114A-C). The example firewall device104includes a network activity log116, and a block list118. The example threat intelligence server106includes a threat prediction engine120. The example reputation and relationship tracking server includes reputation data122and relationship data124. Also shown are the communication network90and sources of malicious network activity92.

The network threat prediction and blocking system100operates to protect a protected network102from sources of malicious network activity92encountered through the connection with the network90.

An example of the network90is the public Internet. The sources of malicious network activity92are typically other computing devices that are also in data communication with the network90.

The sources of malicious network activity92involve threat vectors to which the protected network102would be exposed if not for the network threat prediction and blocking system100. Examples of threat vectors include malicious attacks originating from Internet Protocol (IP) addresses, files, software applications (including computer applications and mobile apps), and uniform resource locators (URLs).

The firewall device104is a network security system that monitors network activity coming in to and going out from the protected network102, which operates to block the threat vectors of the sources of malicious network activity92. In some embodiments the firewall device104generates a network activity log116documenting the network activity. The firewall device104utilizes a block list118to identify network activity that should be blocked to protect the protected network102. Examples of the firewall device104are illustrated and described in further detail with reference toFIGS.3-4.

The threat intelligence server106is a computing device that interacts with the firewall device104and provides a threat intelligence service. In some embodiments the threat intelligence server106includes a threat prediction engine120that operates to predict future sources of malicious activity92that may attempt to attack the protected network102and inform the firewall device104of the predicted sources of malicious activity92to permit the firewall device104to block network activity associated with those sources92. An example of the threat intelligence server106is illustrated and described in further detail with reference toFIG.5.

The reputation and relationship tracking server108is a computing device that provides information regarding the reputation of online elements (e.g. IP addresses, files, software applications, and URLs) and relationships between online elements. For example, in some embodiments the reputation and relationship tracking server108stores reputation data122for the online elements, and classifies the online elements into malicious or non-malicious categories. Some embodiments store relationship data124that identifies known relationships between online elements. In some embodiments the reputation and relationship tracking server provides a service in which reputation and relationship data is sent in response to requests, such as received from the threat intelligence server106. An example of the reputation and relationship tracking server108is illustrated and described in further detail with reference toFIGS.6-7.

Although certain aspects of the system100are illustrated inFIG.1in a particular exemplary implementation, other embodiments can have other configurations. For example, two or more of the devices can be combined onto a single device, or one of the devices can be separated into two or more devices. For example, the firewall device104can be a stand-alone device or part of another computing device (e.g., a server computing device or one of the protected devices114). Similarly, the servers106and108can be combined, or either or both of the servers can be implemented on any number of computing devices, including a server farm. Further, any one or more aspects of the system100can be implemented in the cloud, or on a local computing device. Other embodiments will have other possible configurations as well.

FIG.2is a communication diagram illustrating examples of various possible communications within the network threat prediction and blocking system100. In this example, the system100includes communications140,142,144,146,148, and150.

The firewall device104collects data regarding network activity in a network activity log (116) and sends network log data140to the threat intelligence server106.

The threat intelligence server106receives network log data140and processes the network activity identified therein. For example, the threat intelligence server106identifies a first network activity item and generates and sends a reputation request142to the reputation and relationship tracking server108.

The reputation and relationship tracking server108receives the request142, and searches through its reputation data122(FIG.1) to determine if the online element associated with the network activity has a known reputation. If so, the reputation information144is sent back to the threat intelligence server106. For example, in some embodiments the reputation information144identifies the online element associated with the network activity as malicious or non-malicious. In some embodiments if there is no known reputation, the reputation and relationship tracking server108conducts an investigation to evaluate the reputation of the online element, such as to classify the online element as malicious or non-malicious, and the reputation information144is then returned to the threat intelligence server106.

The threat intelligence server106receives the reputation information144, and determines whether the reputation information144identifies the online element as malicious. If so, the threat intelligence server106determines that the online element is a malicious online element, also referred to herein as a threat vector. For each threat vector identified by the threat intelligence server106, it generates and sends the relationship request146to the reputation and relationship tracking server108to identify any related online elements.

The reputation and relationship tracking server108receives the relationship request146and searches through its relationship data124(FIG.1) to determine if the threat vector has any known relationships with other online elements. If so, the reputation and relationship tracking server108generates and sends relationship information148identifying other online elements that are related to the threat vector.

The threat intelligence server106receives the relationship information148. If relationships to other online elements have been identified, an operation150is performed to repeat the operations including messages142,144,146, and148for the other online elements (including those associated with other network activity listed in the network log data140, or other online elements related to a threat vector as identified by the reputation and relationship tracking server108discussed above). The operation150can be repeated as many times as desired. In some embodiments the process is limited to other online elements that are directly related to (e.g., one degree of separation from) the online element identified in the network activity. In other embodiments, the process is limited to those online elements that are two, three, or more degrees of separation from the online element identified in the network activity. Other limitations can be placed on the number of times that the operation150is performed in other embodiments.

The threat intelligence server106then processes this information from the reputation and relationship tracking server108. More specifically, the threat intelligence server106stores information regarding any threat vectors that were identified directly from the network log data140, and also information regarding any related threat vectors that were identified based on relationships to the threat vectors. The threat intelligence server106then generates updated block list data152for the threat vectors and sends the updated block list data152to the firewall device104.

The firewall device104adds the updated block list data152to the block list118(FIG.1), and operates to block network activity based on the block list118. In this way the firewall device104can operate to block malicious network activity that has already been identified in the network activity log116, as well as other potential threats that are predicted based on the known relationships with other network elements.

FIG.3is a schematic block diagram illustrating one example hardware configuration of the firewall device104. In this example the firewall device104includes network communication devices160and162, a processing device164(which can include one or more processing devices), and a computer-readable storage device166(which can include one or more computer-readable storage devices).

The network communication devices160and162operate to communicate digital data according to one or more data communication protocols. The network communication device160communicates with the network90, and the network communication device162communicates with the protected network102.

The firewall device104typically includes at least one processing device164and at least one computer-readable storage device166. In some embodiments, the computer-readable storage device166stores data instructions that when executed by the processing device164causes the processing device to perform one or more of the operations, methods, processes, or steps described herein. For example, in some embodiments the processing device164implements one or more of the engines described with reference toFIG.4.

As an example, the firewall device104can be one of the next-generation firewall appliances manufactured and distributed by Palo Alto Networks® of Santa Clara, Calif., such as any one of the PA-200, PA-500, PA-2000, PA-3000, PA-5000, and PA-7050 Series firewall appliances.

FIG.4is a functional block diagram illustrating several aspects of an example of the firewall device104. In this example, the firewall device104includes a network activity reporting engine170, a block list updating engine172, a network activity blocking engine174, the network activity log116, and the block list118.

The network activity reporting engine170operates to retrieve data regarding network activity from the network activity log116, and to generate and send network log data140(FIG.2) to the threat intelligence server106(FIG.1). In some embodiments the network activity reporting engine170operates to periodically check the network activity log116for network log data that has not yet been reported to the threat intelligence server106. The period of time can be selected as duration of seconds, minutes, hours, or days, for example.

In some embodiments the firewall device104also includes a network activity log generator, not shown inFIG.4, which operates to monitor network activity and store information regarding the network activity in the network activity log116as it occurs.

The block list updating engine172operates to receive updated block list data152(FIG.2) from the firewall device104, and to add the updated block list data152to the block list118of the firewall device104.

The network activity blocking engine174operates to monitor network activity and to enforce a blocking policy on certain network activity based on the block list118. For example, if an IP address is included on the block list, the network activity blocking engine174can operate to block network activity from, to, or both to and from the blocked IP address. The blocking policy can similarly be enforced against files, software applications, URLs or other network elements.

FIG.5is a schematic block diagram illustrating an example of the threat intelligence server106, shown inFIG.1. In this example, the threat intelligence server106includes the threat prediction engine120. In some embodiments the threat prediction engine120includes a network activity processing engine180and a related threat identification engine182.

The network activity processing engine180operates to process network activity of the firewall device104. For example, in some embodiments the network activity processing engine180receives the network log data140(FIG.2) from the firewall device104and evaluates each of the network activity entries. For example, in some embodiments the network activity processing engine180identifies one or more online elements associated with each network activity, such as an IP address, a file, a software application, a URL, or another online element.

The network activity processing engine180then determines a known reputation for each network activity entry, or the one or more online elements associated therewith. For example, the network activity processing engine180sends a reputation request142(FIG.2) to the reputation and relationship tracking server108, and receives reputation information144in response that identifies the known reputation. In some embodiments the request142is an application programming interface (API) call. Any online elements that are known to be malicious are identified and stored as threat vectors by the network activity processing engine180.

The related threat identification engine182operates to identify any other threat vectors that are related to the threat vector identified by the network activity processing engine180. For example, the related threat identification engine182generates and sends a relationship request146to the reputation and relationship tracking server108, and receives the relationship information148in response. In some embodiments the request144is an application programming interface (API) call. In some embodiments the related threat identification engine182identifies related online objects, and determines whether or not those online objects are malicious or non-malicious. Malicious online objects are stored as related threat vectors. The related threat identification engine182then stores information about the related threat vectors.

The threat prediction engine120then generates the updated block list data152including information about the threat vectors identified by the network activity processing engine, as well as the related threat vectors identified by the related threat identification engine182. The updated block list data152is then sent to the firewall device104(FIG.1).

FIG.6is a schematic block diagram illustrating an example of the reputation and relationship tracking server108. In this example, the reputation and relationship tracking server108includes a reputation management engine186and a relationship management engine188. In some embodiments the reputation management engine186includes a reputation determining engine190, the reputation data122, and a reputation data providing engine192. In some embodiments the relationship management engine188includes a relationship determining engine194, the relationship data124, and a relationship data providing engine196.

The reputation management engine186manages reputation data122documenting and describing reputations of online elements. One example of the reputation management engine186includes one or more of the Brightcloud® IP reputation service, file reputation service, mobile app reputation service, and web reputation service, each of which are available from Webroot Inc. of Broomfield, Colo.

The reputation determining engine190generates, stores, and maintains the reputation data122. In some embodiments the reputation determining engine190is generated based on one or more of, a crawl of online elements such as web pages and contents of the web pages, scans of online elements on the network90, data from global threat sensors, machine learning algorithms, human classification, the relationship data124, or other information or knowledge. In some embodiments the reputation data122includes identifiers of online elements and determined reputations of those online elements (e.g., malicious or non-malicious). Some embodiments include additional reputation information for at least some of the online elements. One example of an identifier of an online element is the address of an IP address (e.g, 555.5.555.555). Another example of an identifier of an online element is a URL. Another example of an identifier of an online element is a hash of the online element, such as an MD5 hash value. The MD5 hash can be used to identify a file or a software application, for example. Such identifiers can be used throughout the system100to identify the online elements.

The reputation data providing engine192operates to provide reputation information144(FIG.2) from the reputation data122in response to a request142. In some embodiments the reputation data providing engine192provides an API interface through which requests142can be made and responses are sent. As one example, the reputation data providing engine192receives an API call requesting reputation information relating to an IP address found in the network activity log116. The reputation data providing engine192performs a search of the reputation data122to find the IP address, retrieves the reputation information144from the reputation data122, and sends the reputation information144to the requestor in response. In some embodiments the reputation information144identifies the online element as malicious or non-malicious (or, alternatively, as trustworthy). In some embodiments, when no reputation information144is found, the reputation data providing engine alerts the reputation determining engine190, which adds the online element to a queue of online elements to be evaluated so that the reputation data122is populated for that online element.

The relationship management engine188manages relationship data124documenting and describing relationships between online elements. One example of the relationship management engine188is the Brightcloud® Security Services system, provided by Webroot Inc.

The relationship determining engine194generates, stores, and maintains the relationship data124. In some embodiments the relationship determining engine194generates relationship data124based on one or more of a crawl of online elements such as web pages and contents of the web pages, scans of online elements on the network90, data from global threat sensors, machine learning algorithms, human classification, the relationship data124, or other information or knowledge. An example of the relationship data is shown inFIG.7, and includes identifiers of the online elements and identifications of known relationships between the online elements.

The reputation data providing engine196operates to provide relationship information148(FIG.2) from the relationship data124in response to a request146. In some embodiments the relationship data providing engine196provides an API interface through which requests146can be made and responses sent. As one example, the relationship data providing engine196receives an API call requesting relationship information relating to an IP address (for example, IP address202shown inFIG.7) found in the network activity log116. The relationship data providing engine196performs a search of the relationship data124to find the IP address, retrieves relationship information148from the relationship data124, and sends the relationship information148to the requestor in response. For example, referring toFIG.7, in some embodiments the relationship data124includes one, two, or more levels of relationship data (describing those online elements that are within one, two, or more degrees of separation of the identified online element).

FIG.7graphically illustrates an example of a portion of the relationship data124of the reputation and relationship tracking server108. In this example, the relationship data associated with an online element, such as an IP address202, is displayed. The relationship data124includes identifiers of the online objects (graphically represented by a square, pentagon, triangle, and hexagon) and the relationships between those objects (graphically represented by lines between the online objects). The relationship data124includes multiple levels of relationship data. In this example portions of three levels of relationship data are shown, including a first level L1, a second level L2, and a third level L3.

In this example, the online element202is directly related to a plurality of other online elements in the first level L1, including IP addresses204, a file206, software applications208, and URLs210(including a particular URL212).

One or more of the online elements in the first level L1may also be related to other online elements. In this example, the relationships to the URL212are shown in the second level L2, which include IP addresses214(including a particular IP address218) and two software applications216. Other online elements in the first level L1may also have related online elements, and such online elements are therefore also part of the second level L2.

One or more of the online elements in the second level may also be related to other online elements. In this example, the relationships to the IP address218are shown in the third level L3, which include IP addresses218and a URL220. Other online elements in the second level L2may also have related online elements, and such online elements are therefore also part of the third level L3. Additional levels can similarly be determined by identifying relationships with the online elements in the third level L3, or subsequent levels.

FIG.8is a flow chart illustrating a method of predicting network threats. In this example the method includes operations232,234, and236.

The operation232is performed to identify a threat vector from network activity log data using one or more computing devices.

The operation234is performed to determine one or more related threat vectors having at least one known relationship to the threat vector using the one or more computing devices.

The operation236is performed to provide data regarding the threat vector and the related threat vectors to a firewall device using the one or more computing devices, so that the firewall can block network activity associated with the threat vector and the related threat vector.

FIG.9illustrates one example of a suitable operating environment900in which one or more of the present embodiments may be implemented. For example, the operation environment is an example of any one or more of the protected devices114, the router110, the firewall device104, the threat intelligence server106, the reputation and relationship tracking server108, and the sources of malicious network activity92(all shown inFIG.1). This is only one example of a suitable operating environment and is not intended to suggest any limitation as to the scope of use or functionality. Other well-known computing systems, environments, and/or configurations that may be suitable for use include, but are not limited to, personal computers, server computers, hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, programmable consumer electronics such as smart phones, network PCs, minicomputers, mainframe computers, firewall devices, distributed computing environments that include any of the above systems or devices, and the like.

In its most basic configuration, operating environment900typically includes at least one processing device902and at least one computer readable media904. Depending on the exact configuration and type of computing device, computer readable media904(storing, among other things, any one of the engines described herein, any of the data described herein, instructions to perform the methods disclosed herein, etc.) may be volatile (such as RAM), non-volatile (such as ROM, flash memory, etc.), or some combination of the two. This most basic configuration is illustrated inFIG.9by dashed line906. Further, computer readable media may also or alternatively include other storage devices (removable,908, and/or non-removable,910) including, but not limited to, magnetic or optical disks or tape. Similarly, environment900may also have input device(s)914such as keyboard, mouse, pen, voice input, touch sensitive display, etc. and/or output device(s)916such as a display, speakers, printer, etc. Also included in the environment may be one or more communication connections,912, such as LAN, WAN, point to point, etc.

Operating environment900typically includes at least some form of computer readable media. Computer readable media can be any available media that can be accessed by processing unit902or other devices comprising the operating environment. By way of example, and not limitation, computer readable media may comprise computer storage media and communication media. Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other tangible medium which can be used to store the desired information. Some embodiments include non-transitory computer storage media. Computer storage media does not include communication media.

Communication media embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Combinations of the any of the above should also be included within the scope of computer readable media.

The operating environment900may be a single computer operating in a networked environment using logical connections to one or more remote computers. The remote computer may be a personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above as well as others not so mentioned. The logical connections may include any method supported by available communications media. Such networking environments are commonplace in offices, enterprise-wide computer networks, intranets and the Internet.

The various embodiments described above are provided by way of illustration only and should not be construed to limit the claims attached hereto. Those skilled in the art will readily recognize various modifications and changes that may be made without following the example embodiments and applications illustrated and described herein, and without departing from the true spirit and scope of the following claims.