Distribution of security rules among sensor computers

摘要

Systems and methods for generating rules in a networking environment having one or more sensor computers logically connected to compromised computers are provided. The rules comprise detection data used by a sensor computer to detect a potential security threat and a specified remediation measure that is caused to be performed when the security threat is detected. A security control computer generates the rules from record of series of actions created by the sensor computer, generates a rule, and distributes the rule to the sensor computers. The sensor computers periodically poll a central database for new rules and store a copy of each rule locally. Using the locally stored rules, the sensor computers can more efficiently and accurately respond to security threats.

主权项

1. A system for improved generation and distribution of security rules comprising:
a plurality of sensor computers, each of which is coupled to a different compromised computer among a plurality of compromised computers in geographically distributed locations, each of the compromised computers comprising at least one malware item that is configured to direct unauthorized network activity toward one or more enterprise networks or enterprise computers, wherein the compromised computers are logically between one or more attacker computers and the one or more enterprise networks or enterprise computers; one or more non-transitory data storage media in each of the sensor computers storing security logic comprising one or more sequences of instructions which when executed cause the sensor computer to perform: using the sensor computer, detecting, from network messages that the compromised computers emit, a series of actions that the network messages cause the enterprise computer to perform that do not correspond to a first security threat that is represented in security threat information stored in memory; using the sensor computer, determining, based on stored detection data, that the series of actions indicates a second security threat; using the sensor computer, recording the series of actions; using the sensor computer, providing the recording of the series of actions to a rules logic or a second sensor computer of the plurality of sensor computers; using the sensor computer, receiving from the rules logic, a second rule comprising at least a portion of the recording of the series of actions as detection data and a second remediation measure; using the sensor computer, using the detection data included in the second rule, identifying the second security threat that is indicated by the network messages; using the sensor computer, in response to identifying the second security threat, performing the second remediation measure.