Integrated cyber network security system and method

[0001] This application claims the benefit of U.S. Provisional Application No. 61/213,469, filed Jun. 12, 2009, which is incorporated by reference herein in its entirety for any purpose.

[0002] The present disclosure relates generally to methods and systems for predicting, detecting, and responding to network attacks.

[0003] As the cyber world continues to expand and become denser, as wireless communications, satellites, telecommunications, and network and Internet infrastructures are integrated, such an increase in breadth and depth also introduces new vulnerabilities by providing cyber hackers with opportunities to use ever more sophisticated means and methods. Such incessant cyber attacks not only erode business integrity and undermine personal well-being but also threaten to compromise national security. Despite the fact that new systems and technologies may be designed with security in mind, the hacker always has the advantage that he may choose the time, place, and method of his attack, thereby rendering security mechanisms that are put into place at one point in time potentially impotent to guard against future attacks that utilize data or resources not known or available at the time of construction.

[0004] Traditional security mechanisms to deal with attacks on and intrusions into private networks, such as firewalls, antivirus programs, and proxy servers, all suffer from certain drawbacks that may render them ineffective at guarding against many modern forms of cyber attack. For example, traditional security mechanisms operate by analyzing and working within the confines of primarily local data and information. For example, proxy servers typically limit their purview to the data that is transmitted outside of the network and the data that is transmitted into the network. In either case, the proxy server is limited to analyzing only the data that passes through it in order to determine whether that data reflects malicious activity. However, it may not be apparent or even determinable solely by analyzing such data whether there is malicious activity involved, as data may be encrypted or obfuscated, and seemingly benign or friendly external destination servers may be merely operating under the control of known malicious servers that are not visible to the proxy server.

[0005] Traditional security mechanisms are also primarily reactive in nature, relying on information about malware programs or attacks that have previously surfaced, and thus previously caused damage, in order to identify those same malware programs or attacks in the future.

[0006] Moreover, traditional security mechanisms suffer from the additional drawback that they are largely aimed only at preventing network intrusions from occurring and are thus largely ineffective at taking targeted and granular remedial actions once intrusions do occur.

[0007] The present information processes and collects global information to provide real-time, locally relevant and actionable threat defense management and response options. This information is integrated with local sensing, allowing for the real-time correlation of vulnerabilities with the presence of malicious activity, whether latent or manifest. This approach expedites the action taken to not only minimize attacks, but also to minimize attack opportunities and attack impact. The receipt of this globally collected and processed information can also be used to take more granular and automated action in order to minimize operational impact.

[0008] This approach also provides a mechanism by which the system can be inoculated against the threat until the appliance or application patch is developed, the system can be reconfigured in anticipation of future attack vectors, or, where applicable, active defense measures can be deployed to remove the threat. The global sensors that collect the raw threat and vulnerability information are driven by this learning mechanism to provide efficient and timely harvesting.

[0020] FIG. 1a is a diagram of an exemplary internal network interfacing with the Internet and utilizing global sensors, consistent with certain disclosed embodiments. As shown in FIG. 1a, network 110 may include one or more computers, e.g., user workstations 113a-113e; one or more internal servers, e.g., servers 112a-112b; one or more mobile devices, e.g., mobile phone 114 and/or personal digital assistant (PDA) 115. Each device in network 110 may be operatively connected with one or more other devices, such as by wired network cable, e.g., cat5 Ethernet cable 118; wireless transmission station, e.g., stations 116a-116b; network router, e.g., router 117, etc. It will be appreciated by those skilled in the art that many other types of electronic and analog devices may be included in network 110 or may be connected in different manners. It will also be appreciated by those skilled in the art that the devices resident in network 110 need not be physically collocated but may also be geographically spread across buildings, jurisdictional boundaries, and even foreign countries. Moreover, a given device may reside within multiple networks or may become part of a network only when certain programs or processes, such as a virtual private network, are operating.

[0021] Devices within network 110 may communicate with devices outside of the network, such as devices connected to the Internet 120, by, for example, directing communications to a proxy server 119, which first examines the nature of any data attempted to be transmitted out of network 110 to ensure that no private information is being transmitted out of the network or that no data is being transmitted to a location known to be suspect. If proxy server 119 is satisfied that there are no problems with the information being transmitted from a device within the network 110, proxy server 119 may forward the information itself to the device that was the intended recipient device (not shown) of the communication from the device in network 110. If any data is transmitted back from the recipient device, the proxy server may first inspect the data to ensure that there are no harmful programs or other data in the received communication, such as by comparing the received data with a series of known signature strings. If proxy server 119 is satisfied that the data received from the recipient device is safe, proxy server 119 may forward the received communication to the device within network 110 that was the intended recipient of the communication.

[0022] Network 110 may additionally include a firewall 111. Firewall 111 may examine communications to and from devices within network 110 to ensure that devices within network 110 are not communicating with known suspect locations or devices. Firewall 111 may additionally prevent devices within network 110 from communicating through ports known to be associated with harmful or malicious programs, and firewall 111 may block communications from external devices when those communications attempt to use suspect ports. Firewall 111 may additionally use a list of only those programs that are allowed to transmit and/or receive data outside of the network (i.e., a white list) or a list of programs that are specifically identified as prohibited from transmitting or receiving data outside of the network (i.e., a black list). It will be appreciated by those skilled in the art that firewall 111 may be implemented by hardware, software, or both. It will also be appreciated that each device within network 111 may alternatively or additionally have its own firewall.

[0023] As shown in FIG. 1a, the present invention comprises the strategic placement of global sensors, e.g., sensors 121a-121e, throughout the Internet for the purpose of detecting and collecting information related to potential threats to network 110. It will be appreciated by those skilled in the art that global sensors need not be truly “global” in the international sense, but may only be external to the network sought to be protected or able to send and receive communications to devices outside of the network. Global sensors 121a-121e may be personal computers, servers, routers, or other devices configured to communicate with devices outside of the network and/or inspect or monitor network traffic and transmit and receive data. Global sensors 121a-121e may also include or involve human operators who, for example, provide inputs to the global sensors or analyze semantic content not readily understandable by the global sensors.

[0024] Although not shown in FIG. 1a, the present invention contemplates that one or more devices within or associated with network 110 may communicate with one or more global sensors, e.g., to receive information from the global sensors about potential threats detected by the global sensors, such as viruses, malicious bots, or phishing attempts. The global sensors may maintain constant communication with devices associated with network 110 in order to deliver information in real time or in near real time as potential threats are detected.

[0025] Alternatively, since one or more global sensors may become infected or commandeered by malicious bots or viruses, it may be preferable to avoid direct connection between the sensors and any network 110 devices to prevent any such malicious program from spreading to the network 110 devices. Thus, the global sensors may instead communicate with network 110 by means of “push” and/or “pull” technologies whereby the global sensors, for example, rather than directly sending any data to network 110, instead post data to a server or other resource known to a network 110 device from which that network 110 device may download the data at arbitrary times, thus protecting network 110 devices from direct communication with a potentially infected global sensor. In addition, global sensors may first encrypt any data to be communicated to network 110 devices prior to transmitting that data either directly to any network 110 devices or indirectly by means of “push” or “pull” techniques.

[0026] FIG. 1b is a diagram of an exemplary system for utilizing global sensors to provide tailored threat management information to an internal network, consistent with certain disclosed embodiments. FIG. 1b depicts a further exemplary embodiment in which information collected or analyzed by global sensors 131a-131e in a network 130, such as the Internet, is forwarded to a global threat manager 140, for example in real-time or near real-time. Global threat manager 140 performs further analysis of the data received from global sensors 131a-131e, for example in real-time or near real-time. For example, global threat manager 140 may further cull relevant information from non-relevant information or further winnow out false positives, may check the received information against data sources or repositories, such as subscribed security information feeds or host reputational databases, or may perform further data collection processes, either by itself or by sending further instructions to one or more global sensors, in response to the received information.

[0027] Global threat manager 140 may also categorize the information or otherwise order the information according to specific types of networks 170 or specific vulnerabilities within those networks. For example, network 170, which represents a network intended to make use of the information collected by global sensors 131a-131e and further analyzed by global threat manager 140, may be a small corporate intranet containing only a small number of user workstations running Microsoft Windows®-based operating systems and including a number of industry standard desktop publishing software applications. In that case, network 170's security concerns may be limited to Windows vulnerabilities, viruses, and email scams, and there may be no need for predictive information related to threats such as “denial of service” attacks or current vulnerabilities related to the Linux operating system. Accordingly, local threat manager 160 may provide information to global threat manager 140 regarding the characteristics of network 170 and the type of predictive security information needed. Using this information from local threat manager 160, global threat manager 140 may select only the information received from global sensors 131a-131e, or the information derived from further analysis of the information received from the global sensors, that is relevant to network 170 and may forward that relevant information in real-time or near real-time to local threat manager 160.

[0028] After receiving threat detection and prediction information from global sensor 140 that is appropriately tailored to the needs of network 170, local threat manager 160 then uses that information to provide local threat prediction, detection, and remedial operations in network 170. For example, local threat manager may employ a number of local sensors 171-175 throughout network 170 that actively monitor communications into the network (entry sensor 171), communications out of the network (leakage sensor 175), or communications or operations within the network (signature sensor 172, performance sensor 173, and behavior sensor 174) based on the information provided by local threat manager 160.

[0029] At the same time, additional networks 170 may contain local threat managers 160 that communicate with global threat manager 140 for the purpose receiving predictive security information related to the individual characteristics of each different network 170.

[0030] Global threat manager 140 may also include active defense functionality 150 for the purpose of not only collecting global threat information but also taking affirmative action related to global threats. For example, active defense functionality 150 may include functionality for attacking, disabling, or otherwise neutralizing a device in network 130. Global threat manager 140 may, for example, receive information from local threat manager 160 concerning a certain device or technique that is being used to attack or infiltrate network 170. Global threat manager 140 may then use that information to attempt to shut down resources currently being employed by the offending device, to disable the device, or to report information related to the device to appropriate authorities or parties.

[0031] Those skilled in the art will appreciate that the foregoing structure is exemplary only, and that many different variations may be used concerning the types and number of global sensors, global threat managers, and local threat managers (including local sensors). It will also be appreciated that the precise functions and responsibilities assigned to the different components of the system described above are exemplary only, and that various functions may be differently distributed or even duplicated among the various components of the system. Thus, for example, the global sensors may themselves take active defense measures or may categorize collected information into categories or priorities. Likewise, the global threat manager may perform some functions described above in connection with the local threat manager or vice-versa. Regardless of the specific allocation of functions among the different components of the system, the present invention contemplates that these functions may be performed in an automated and real-time or near real-time manner that provides local networks with highly current information concerning new attacks or threats. This approach eliminates the need to wait for third-party vendors to first analyze, often by human operators, threats that have already materialized or attacked existing networks and to develop patches to fix vulnerabilities related to such threats.

[0032] FIG. 2 is a diagram depicting the communications of an exemplary global sensor. As shown in FIG. 2, global sensor 210 may communicate with a plurality of devices, such as servers 220a-220d or personal computers 230a-230e. Global sensor 210 may be connected to one or more devices by direct communication link, as depicted in FIG. 2, or merely by means of being connected generally to a network, such as the Internet, such that global sensor 210 is capable of communicating with one or more devices through the network.

[0033] Global sensor 210 may monitor Internet or other network activity by means of directly communicating with other devices on the Internet or by simply listening to communications between other devices when global sensor 210 is able to be privy to such communications, such as when global sensor 210 is on a carrier sense multiple access with collision detection (CSMA/CD) Ethernet channel and receives communications to and from all devices on the same channel irrespective of the intended recipients of such communications.

[0034] Global sensor 210 may monitor malicious Internet activity by actively searching for malicious activity by, for example, visiting websites or communicating with servers or domains associated with previously known attacks, viruses, or phishing attempts. Global sensor 210 may also visit websites or servers that, despite having no previously known associations with malicious activity, nonetheless fall within certain categories of content or behavior frequently associated with malicious activity, such as chat rooms, hacking, warez, spamming, illegal file-sharing, or adult websites. Global sensor 210 may download content from such websites to examine whether it contains any viruses or bots. Global sensor 210 may utilize geo-location techniques based on IP addresses to focus on websites and servers located in certain geographical locations known to have previous significant malicious activity. Global sensor 210 may also automatically subscribe to email list-serves hosted by various websites or may actively publish its email address throughout the Internet or at select strategic locations, such as chat rooms, in order to make its email address available for harvesting by spiders and other programs that crawl the net to collect email addresses. Global sensor 210 may also do the same with its IP address. Global sensor 210 may additionally or alternatively take passive measures to ensure that it leaves itself open for attack, such as leaving all or select ranges of ports open that might otherwise be blocked by firewalls and other software.

[0035] Global sensor 210 may additionally receive feeds containing information relating to any number of network security categories, including but not limited to threat signatures and/or behaviors, such as malware, phishing, and defensive response options; vulnerabilities; attack patterns; Internet architecture; cyber news; deployed local threat management (LTM) systems; human cyber subject matter expert (SME) analysis; hacker conferences, small group meetings, and publications; and physical network sensors on the Internet, extranet, and/or intranet.

[0036] Moreover, global sensors are not limited to the analysis of only raw data that is syntactically relevant to computers and other devices, but may also be programmed with various language and other content scanning and analysis software that enables the global sensors to analyze and report on semantic information, such as blog, email, chat room, or other human communications.

[0037] The foregoing methods of monitoring the Internet for malicious activity or potential threats are exemplary only, as those skilled in the art will appreciate many other ways of actively searching for potential threats or making a device open to attack.

[0038] The use of global sensors to proactively seek out potentially malicious programs and activities may be useful for overcoming a number of limitations common to traditional security mechanisms that rely on local information or are primarily reactive in nature. For example, malicious software robots or “bots” may enter into a network for the purpose of stealing information, controlling the network, or launching other attacks from the network to steal money. Such bots typically operate using a command and control protocol whereby they transmit any private information they obtain to a central server or other device, the “master,” that may also provide additional instructions for how they are to operate.

[0039] Traditional security mechanisms suffer from the drawback that they must know in advance whether a particular external location is malicious in order to block any communications to that location. For example, a proxy server may not know that a request that is being made to a particular server is problematic because the domain associated with that server may have been registered only within the last week and there has not yet been any reported malicious activity associated with that domain.

[0040] Moreover, these traditional security mechanisms are ineffective at countering what are known as “polymorphic” bots. Polymorphic bots differ from normal bots in that, rather than being “hardwired” to communicate with their master and thus having their master's location (e.g., domain, IP address) encoded within their binary structure, instead they will have only an algorithm to execute at the appropriate time to ascertain the identity and location of their master. For example, the bot may know only that at a certain time and date that it is to execute a function that will take disparate pieces of information and combine them to reveal the name and location of its master. The bot master itself may not be accessible or even in existence until just prior to the time at which the bot is programmed to communicate with it. For example, the bot's internal algorithm, once executed, may yield the seemingly random string of characters “cn109cnz.” However, just prior to the execution of that algorithm, the bot master may have registered the domain name “cn109cnz.net” as the location at which it may receive communications from the bot. The bot and bot master are therefore able to dynamically establish a completely new communications channel that, by virtue of having no prior history, will likely not be identifiable as malicious in nature.

[0041] By focusing only on local events and conditions, for example the digital structure of the polymorphic bot, which cannot reveal the location of the bot master until just prior to transmission, or the communications that pass through the proxy server or firewall, which may be encrypted and therefore not identifiable as containing private data, traditional security mechanisms may be ineffective at preventing polymorphic bot attacks. Likewise, polymorphic bots present a challenge to traditional security mechanisms, which are primarily reactive in nature, given that they rely on a bot's having been previously successful before they are able to recognize that bot's communications as suspect.

[0042] By contrast, the present invention is able to overcome these limitations by actively scanning the Internet for global information that can be used to predict, identify, and counter polymorphic bots. For example, and without limitation, global sensors may monitor new domain name registrations to determine potential locations for new bot masters to spring up and may block communications by any programs that attempt to transmit data to such locations.

[0043] FIG. 3 is an exemplary flow diagram illustrating a method of monitoring new domain name registrations, as depicted in FIG. 4, to locate and collect information associated with potential future attacks, as depicted in FIG. 5, consistent with methods and systems of the present invention. Global sensor 210 may receive or access a daily list 410 of new domain names that have been registered (step 310). For each domain name on daily list 410, a global threat manager segment of global sensor 210 may evaluate the domain name according to criteria designed to indicate the likelihood that the domain name may be associated with malicious activity (step 320).

[0044] For example, such predictive and non-predictive criteria may include a determination as to whether the domain name includes human-readable words or expressions, or is instead a string of seemingly random characters (step 331). Given that most persons and companies have an obvious incentive to make domain names memorable and intuitive in order to attract visitors, a newly registered domain name without any known human-readable words or expressions may indicate that the domain name is malicious, was registered by a program that creates seemingly random domain name strings according to internal algorithms for the purpose of registering large numbers of domain names, and that the domain name may be associated with malicious cyber activity.

[0045] List 420 in FIG. 4 depicts a set of domain names that have been culled from daily list 410 by the global threat manager because there are no human-readable words or expressions in the domain names. Those skilled in the art will appreciate that the set of suspect domain names 420 may be over-inclusive, as some domain names, e.g., “k8e1984. biz” may in fact represent mnemonics, i.e., “Katie, born in 1984, ” that are not recognized as having human associations and are therefore flagged as false positives in the set of suspect domain names 420.

[0046] As another example, the global threat manager may attempt to determine whether a website associated with the newly registered domain has content almost immediately after the domain name was registered (step 332). Given that it may be more typical for there to be a delay between the registration of a domain and the development of content associated with that domain for most legitimate personal and commercial websites, the creation of immediate content may additionally serve as an indication of potential malicious activity associated with the domain name. A domain name may additionally be flagged as suspect even if it contains human-readable expressions or otherwise satisfies other criteria that would suggest its presumed legitimacy if the domain nonetheless has associations with other known or suspected locations, registrants, or threats. For example, a human-readable domain name may have been registered by or to an entity associated with previous suspect domain names or malicious activity.

[0047] Additional mechanisms that may be used for the detection of suspect Internet hosts include examining communications by hosts to determine whether such communications adhere to various trust and operational models associated with communication protocols or otherwise exhibit typical behaviors, as violation of standard protocol or behavioral models may be a key predictor of malfeasance. The examination of Internet hosts and networks may also be performed in the context of other attributes that wrap the logical details in a social structure. Such other attributes may include WHOIS information, Autonomous System (AS) ownership information, phishing sources, IP block-list information, and compromised host information. Those skilled in the art will appreciate that there can be many additional criteria that may be used to determine and predict whether a newly registered domain name may be suspect in nature.

[0048] In the event that the global threat manager detects a suspect domain name, that domain name may then be fed into a local threat manager (step 340). The local threat manager may then execute a number of functions to ascertain additional information associated with the domain name, such as the IP address associated with the domain name (step 351), other domains hosted at the same IP address (352), as specified by the Domain Name System (DNS), or even a range of IP addresses that contains the IP address (353), which may reflect a geographical location from which cyber attacks may potentially be concentrated.

[0049] List 430 in FIG. 4 depicts a set of IP addresses associated with the set of suspect domain names 420, consistent with the foregoing techniques. Those skilled in the art will appreciate that many additional pieces of information, such as, without limitation, the names or addresses of entities to whom such domains are registered or the Media Access Control (MAC) addresses of various devices hosting the domain (if ascertainable), could also be included in list 430 and therefore specified as further criteria.

[0050] Finally, steps 360 and 370 reflect the iterative nature of the above-described process, as each domain name included in daily list 410 may be subject to one or more of the operations depicted in FIG. 3.

[0051] As the global sensor collects this information and either compiles it itself or forwards it to another device to perform compilation and analysis, a database or other collection of information, such as the one depicted in FIG. 5, is populated and may be continually updated with identification information used to detect potential threats. Those threats may include malicious programs, email, or other communications that attempt to enter network 110, or may already reside within network 110 but have yet to be detected, for example, due to inactivity within the network or failure to attempt to communicate with devices outside of the network.

[0052] For example, as depicted in FIG. 5, user workstation 510 may be infected with a bot or other malicious software program. Such a bot may have entered the network undetected due to an encoding that reflects a domain that has not yet been registered, or the bot may by polymorphic in nature and not contain any domain or IP address information within its binary structure until it computes such information dynamically at a designated point in time after having entered the network.

[0053] At a designated point in time, for example, after having collected sufficient private or sensitive information from workstation 510 or other devices in the network, the bot may attempt to transmit the data to its master using IP address 520. However, prior to any communications entering or leaving the network, server 530 may first inspect communications to determine whether they include any information contained within database 540. In this example, server 530 will recognize IP address 520 as having been entered into the database by virtue of its association with a recently registered suspect domain name, as depicted in FIG. 4. Server 530 may then prevent the communication from leaving the network and may further alert the proper personnel and/or automated security mechanisms about the device (i.e., workstation 510) associated with the suspect communication and the process identifier (“ID”) of the process that initiated the communication, upon which appropriate investigative and potentially remedial action may be taken. Thus, the present invention provides a significant advantage over the prior art by utilizing global information to predict, detect, and neutralize malicious programs that were not or could not have been identified as malicious upon their original entry to the network.

[0054] As indicated by steps 352 and 353, the identification data stored within database 540 need not all be originally collected from global sensors, but may additionally come from further analysis of the data supplied by the global sensors. For example, database 540 may store additional domain names that are hosted by the same IP address as one or more domain names identified as suspect. Likewise, if one or more global sensors provide information concerning a number of suspect IP addresses that all fall within a certain range, server 530 or other devices tasked with analyzing the data in database 540 may additionally decide to flag as suspect any IP address within that range, even though various IP addresses within the range may not have been forwarded as suspect by any global sensors. Additionally, global sensors or other devices may monitor DNS registrations to keep track of new IP addresses that may be associated with suspect domains that are reassigned to different IP addresses and may store such additional IP addresses in database 540. DNS registration patterns may also be used to estimate the reputation of an IP address or domain name by tracking new registrations, rapidly changing registration data, and association with low reputation hosting providers.

[0055] Those skilled in the art will appreciate that the above-described method of collecting global information that may be used to identify potential threats is exemplary only and that there are many additional ways to monitor, collect, analyze, and/or compile such information. Those skilled in the art will also appreciate that server 530, or another device tasked with monitoring communication within or proceeding from the network, may choose to not require a perfect match between information contained within the attempted request out of the network and information within database 540, but may instead apply rules that calculate degrees of similarity, association, or probabilities of correspondence with one or more pieces of information within database 540.

[0056] Those skilled in the art will also appreciate that the present invention is not limited to communication from devices within the network to devices outside of the network, but may additionally be used to monitor communications from devices outside of the network to devices within the network or communications between devices within the network. In fact, the present invention may also be used to analyze any and all data in the network, even if that data is not part of a communication, attempted or otherwise. For example, under the present invention, otherwise static or non-ambulatory data, such as files or user workstation hard drives, may be monitored or scanned on a regular basis to detect whether any malicious programs or kinds of threats may reside therein, whether by virtue of recent arrival into the network or workstation or new information collected from global sensors that would allow threats previously assumed to be benign in nature to be recognized as suspect.

[0057] The present invention also contemplates that data retrieved from global sensors may be combined with data received from other sources, such as vendor-supplied lists of additional threats or patterns to monitor. Moreover, such vendor-supplied data may be forwarded to one or more global sensors in order to provide the global sensors with starting points or “leads” for looking for malicious activity. The global sensors may also receive periodic information or updates for the purpose of “tweaking” or optimizing the manner in which the global sensors search for or collect information based on further analysis of information previously forwarded by the global sensors, vendor-supplied information, or any other information that may be used to further configure, redirect, or optimize the performance of the global sensors.

[0058] The present invention also contemplates that global information (e.g., information outside of the network) may be captured, analyzed, and used to detect threats through means other than global sensors. For example, any attempted communications into the network or out of the network may be analyzed to see whether they are of a malicious nature or whether they are able to provide information about other potential threats. Moreover, the present invention contemplates that such analysis may be performed across the many layers of the networking stack and the current operating environment, with a view of the infrastructure vulnerabilities. This perspective provides more complete information on the threat environment that is directly applicable to user applications and behavior down through the protocols and behaviors of the underlying hosts and devices.

[0059] One example of such malicious communications is the technique of “phishing.” Typically, in a phishing attempt, a hacker, through a server or other device, sends a user an email that purports to and appears to be from an institution with which the user may have an account, for example a bank. The phishing email typically informs the user that his or her account has been temporarily suspended, for example due to supposed unauthorized activity associated with the user's account, and invites the user to log into his or her account to reauthorize the account. The email typically provides a link that, when clicked, takes the user to a website that is designed to mimic the bank's user login screen but in fact is hosted by the hacker's server. If the user attempts to “log in” by supplying the counterfeit website with his or her username and password, the hacker is provided with the user's login credentials and is then able to log into the user's actual bank account in order to perform malicious activity such as identity theft or the transferring of funds to an account owned by the hacker.

[0060] FIG. 6 is an exemplary flow diagram illustrating an analysis of malicious emails, such as phishing attempts, to locate and collect information associated with potential future attacks, as depicted in FIG. 7, consistent with methods and systems of the present invention. In step 610, an email 720 sent from a device outside of the network (not depicted) to a user workstation 710 within the network is first intercepted and examined by a security device 730. In step 620, security device 730 analyzes the email to determine whether the email may be a phishing attempt. Such analysis may involve scanning for keywords included within the email body 720d that are common among phishing emails, such as “login,” “unauthorized,” or “bank.” Security device 730 may also detect misspelled words or incorrect grammatical constructions, which are typical in phishing attacks. Security device may also evaluate whether a link in the email contains an anchor attribute that does not match the anchored text, for example a link that displays as “www.suntrust.com,” yet points to http://login.suntrust.qucn10n.net/?cna=18u3. Those skilled in the art will appreciate that there may be a number of techniques for analyzing the content of the email to determine whether it may be malicious in nature. Security device 730 may alternatively or additionally identify phishing attempts based on other information associated with the email, including without limitation, the email's routing information 720a, sender information 720b, and/or recipient information 720c.

[0061] In the event that the email is not identified as a likely phishing attempt (step 620, No), security device 730 may forward the email to the intended recipient (step 630). In the event that the email is identified as a likely phishing attempt (step 620, Yes), security device 730, or another device, may analyze data associated with the email to identify other potential threats, current or future.

[0062] For example, sender information 720b, if accurate, may reveal a domain 740a and associated IP address 740b that may be added as identification information to database 740 (steps 641 and 642), which in some embodiments may be a further expansion of the information contained in database 540 in FIG. 5. Additionally, other domains, IP addresses, or other information contained in or related to email 720 or routing information 720a may also be placed into database 740 (steps 643 and 644). Finally, email 720 may be quarantined or placed in an appropriate location for either discarding, forwarding to authorities or other interested parties, or notifying the intended recipient to provide the recipient with an opportunity to ratify or modify the identification of the email as illegitimate (step 650).

[0063] As previously described in the embodiment of FIG. 5, the information contained in database 740 may be used to identify other potential threats. For example, an attempted communication from a device within the network to a device outside of the network may be identified as suspect if that communication is to IP address 740b or any other IP address associated with routing information 720a. Although the program initiating the attempted communication may not have been initially detected as malicious when it first entered the network, its attempt to communicate using information associated with a previously detected malicious activity—namely, phishing email 720—allows security mechanisms to now recognize it as potentially malicious and to take appropriate corrective action. The present invention therefore overcomes the limitations of the prior art by using global information to identify malicious activity that could not be detected using solely local information such as the structure of the malicious program itself.

[0064] Once again, it will be appreciated by those skilled in the art that the present invention is not limited to collecting identification information from emails alone, but also contemplates collecting information from any and all communications to, from, or within the network. Moreover, the present invention also contemplates the harvesting of information from within the network, even if that information is not contained within communications, attempted or otherwise. For example, in the event that malicious programs or activities are detected within the network or located by global sensors outside of the network, security device 730 may analyze such programs or activities to compile information about them, such as, without limitation, structural signatures, behavioral or network signatures, and/or associated domain or IP address information. Security device 730 may use this information to identify future threats, including malicious programs or communications. Moreover, security device 730 may further use such information to re-scan past network traffic to assure that newly discovered threats are not and have not been in the network.

[0065] Those skilled in the art will also appreciate that the present invention is not limited to the collection of data directly harvested from malicious programs or suspect communications, but may also be derived from analyzing such original data to collect and amass further data that is either related to the original data or may be inferred from it. The present invention also contemplates that security devices may also attempt to visit or otherwise communicate with any servers associated with suspect domains or IP addresses to attempt to gain additional information from such servers, such as detecting any malware or viruses resident on those servers. Further information associated with those malwares or viruses may additionally be analyzed and entered into database 740 to identify potential future threats.

[0066] This technique of proactively searching for such malware or viruses that may have not yet become widely disseminated among the Internet or detected by other security mechanisms thus allows the present invention to overcome the reactive and locally focused limitations of the prior art. Moreover, the present invention contemplates that such information associated with any malware or viruses found as a result of communicating with servers associated with phishing attempts or other malicious activity may itself lead to the discovery of additional domains, IP addresses, or servers that may be identified as malicious and from which identification information may be harvested. The identification of malicious activity within or outside of the network may thus lead to a non-terminal chain of analysis, investigation, and identification whereby new domains, IP addresses, servers or other data are continually identified and information associated therewith is continually catalogued into database 740.

[0067] As previously mentioned, the present invention also contemplates that information contained database 740 may contain false positives, as, for example, emails may be falsely identified as phishing attempts or servers or domains through which genuinely malicious emails or programs have passed may actually be benign in nature despite having been an unknowing conduit for malicious activity. Therefore, the present invention contemplates a nuanced approach to cataloguing identification information in database 740 and detecting potential threats based on that information. For example, the invention may utilize information either collected or purchased from vendors regarding reputations of, for example, servers, domains, IP addresses, or geographic locations and thereby grant emails associated with any of the foregoing certain presumptions of legitimacy or illegitimacy. Thus, for example, an email may be preliminarily flagged as potentially fraudulent or illegitimate in nature, such as a phishing attempt, by the system. However, the email may be associated with a server, domain, IP address, or geographic location that is granted a presumption of legitimacy by virtue of prior legitimate activity or a lack of history of malicious activity stemming from the geographic region. The email may, therefore, either not be marked as malicious or may be forwarded to a manual operator to make a determination as to whether the email is malicious rather than being automatically marked as such.

[0068] Once a threat to the network or other malicious activity within the network has been detected, the present invention contemplates a dynamic and operationally-aware approach to neutralizing the threat that involves evaluating a number of alternative remedial responses against a continually updated model of the network in order to evaluate the likely effect of each alternative response prior to taking any corrective action. In one exemplary embodiment, this evaluation occurs pursuant to an automated, near real-time, execution of the dynamic network model to score the alternatives against a set of parameters that permit preservation of the fundamental mission of the network infrastructure. Such an automated evaluation of the mission impact may enable a “man-in-the loop” selection based on the scores or an automated implementation of the selected response based on the current in-force policies.

[0069] FIG. 8 is an exemplary flow diagram illustrating a process of testing potential procedures for responding to network attacks against a network model according to weighted criteria. As depicted in FIG. 9, a network 960 is continually monitored to detect any structural or functional changes within the network. At the same time, a network model 950 may be maintained and in some cases continually updated to reflect the current state of the network 960. Network model 950 allows system administrators to know the state of network 960 at all times and also provides a tool for evaluating the impact of modifications to the network 960 by first testing those modifications against the network model 950.

[0070] A correlation detection engine 910 may continually monitor network 960 to detect threats or attacks that are directly applicable to vulnerabilities that are present on the network infrastructure. This correlation function is not limited to directly present vulnerabilities, but may also comprise aggregate effects that are on balance a threat to the network. Once correlation detection engine 910 detects a threat 910a to the network (step 810), for example a threat that matches a vulnerability that is known to be on the network, correlation detection engine 910 creates an alert 910a and feeds that alert into policy engine 920. Policy engine 920 evaluates the threat and determines if action is needed based on the policies that are currently in force. Under the current policies, if the policy manager determines that an action is necessary, policy engine 920 generates one or more response policies 920a, which are potential procedures for neutralizing the threat 910a (step 820). Policy engine 920 may generate response policies 920a dynamically by examining network model 950 to determine which procedures would be effective for neutralizing the threat 910a. Policy engine 920 may also be programmed in advance with standard response procedures for responding to various threats that are not as dependent on the current state of the network 960. In certain embodiments, policy engine 920 will generate response policies 920a that range from gross in nature, such as disabling all in-bound and out-bound communications, to more granular in nature, such as shutting down a certain port number in a particular workstation or server, to benign in nature, such as taking little or no action. Policy engine 920 may also generate response policies 920a that approach the problem of neutralizing threat 910a from a number of different angles and using a wide range of different techniques.

[0071] Policy engine 920 feeds the set of response policies 920a into a response engine 930 (step 830). Response engine 930 evaluates the effects of implementing response policies 920a by, for example, testing each policy against network model 950 to determine what the likely physical and functional impact 950a of the policy would be if implemented in the actual network 960 (step 840). Response engine 930 may also use a priority table 940 that contains priorities 940a or weighted criteria reflecting priorities of operations, departments, devices, personnel, and/or other aspects of the organization. In some embodiments, after response engine 930 has evaluated the impact 950a of a response policy 920a, response engine 930 determines a score 930a, for example, by comparing a policy's network impact 950a to priorities 940a supplied by priority table 940 (step 850).

[0072] For example, as depicted in FIG. 10, priority set 1010 may indicate that the continued and uninterrupted operation of the organization's accounting department may be the most important factor, indicated by a weight of 7.5 out of 10, when considering any potential response to a network attack, whereas the continued operation of the human resources department may be a less important factor, indicated by a weight of 2.3. Policy engine 920 may propose one potential response policy 920a for responding to a network attack that comprises disabling email access for the entire enterprise. Response engine 930 may determine the network impact 950a of the response policy 920a of disabling email access by testing that policy against the network model 950. The network impact 950a may indicate that such a policy would have a significantly negative impact on some departments within the enterprise, such as accounting and human resources, while not effecting other departments as severely. Applying priority set 1010 to the determined network impact 950a of response policy 920a, response engine 930 might assign a low score 930a to response policy 920a due to its negative impact on the accounting department, the continued operation of which is assigned significant weight in priority set 1010.

[0073] Alternatively, policy engine 920 may propose a second potential response policy 920a for responding to the network attack that comprises blocking all communications that utilize a particular port number. Response engine 930 may determine the network impact 950a of the response policy 920a of blocking certain port communications by testing that policy against the network model 950. The network impact 950a may indicate that such a policy would have minimally negative impact on the accounting department, a significant impact on the human resources department, and a moderate impact on the out-bound communications of the enterprise. Applying priority set 1010 to the determined network impact 950a of response policy 920a, response engine 930 might assign a higher score to response policy 920a due to its low impact on the strongly weighted accounting department, despite its significant impact on the less strongly weighted human resources department. Thus, using priority set 940a, response engine 930 may determine the desirability of certain potential responses to a network attack according to current enterprise priorities by identifying the response having the highest score (step 880) and thereby implement the response that has the least negative aggregate impact on the various priorities within the enterprise (step 890).

[0074] Moreover, as depicted in FIG. 10, priority table 1000 may include multiple, alternative priority sets 1010, 1020, and 1030 that may be used to evaluate potential responses depending on factors such as the time of day, the state of current mission operations, or the severity of the attack. For example, in the event that a network attack occurs during non-working hours, response engine 930 may use priority set 1020 instead of priority set 1010. Priority set 1020 may reflect a decreased importance of the continued operations of the accounting department, and may instead reflect an increased importance of the continued operations of the field operations department given that there may be fewer employees working to handle field operations matters manually in the event of an interruption of automated services. Using priority set 1020, response engine 930 may determine that a number of potential response policies 920a that may have scored lowly under priority set 1010 during normal business hours now score more highly.

[0075] Likewise, there may be times when, due to the pendency of certain mission-critical operations, response engine may use priority set 1030, which significantly prioritizes uninterrupted field operations over all other considerations. In such a situation, response engine 930 may elect to pursue certain remedial courses of conduct, such as disabling entire servers or sub-networks, that drastically impact other operations of the enterprise in order to ensure continued field operations.

[0076] Those skilled in the art will appreciate that priority table 1000, as well as priority sets 1010-1030, may be organized or structured in many different ways and may reflect many different types of priorities and associated weights. Moreover, priority table 1000 may include priority sets that, rather than providing static and independent weights for each priority, contain complex and inter-dependent relationships between the different priorities. For example, although out-bound communications may be weighted lower than in-bound communications in priority set 1010, priority set 1010 may also contain algorithms that cause the weight attached to out-bound communication to begin to increase once the negative impact on in-bound communications has reached a certain threshold. Priority table 1000 may additionally provide functionality for dynamically determining or weighing different priorities based on conditions such as the time of day, the state of the network, the nature of the threat, or user input.

[0077] The foregoing description of the invention, along with its associated embodiments, has been presented for purposes of illustration only. It is not exhaustive and does not limit the invention to the precise form disclosed. Those skilled in the art will appreciate from the foregoing description that modifications and variations are possible in light of the above teachings or may be acquired from practicing the invention. Accordingly, the invention is not limited to the above-described embodiments, but instead is defined by the appended claims in light of their full scope of equivalents.