TECHNICAL FIELD

The present disclosure relates to secure search and management of computers in computer networks.

BACKGROUND

Network administrators (e.g., administrators of enterprise-level networks, such as banking networks, e-Commerce networks, etc.) often hire third-party cybersecurity companies to monitor and respond to threats. Thus, those responding to security incidents are often located remotely from the network rather than within it. Nevertheless, when a possible threat is detected, security incident responders need to be able to perform forensic investigations on machines within the network, e.g., by inquiring into events at the machines. But because network machines are often isolated from (e.g., remote from) the servers used by security incident responders (e.g., isolated by a firewall), it is difficult for these remote servers to communicate directly with machines within the network. Network administrators simply do not want to allow direct communication of remote computers with machines within their networks if the channels of communication cannot be trusted.

SUMMARY

Accordingly, there is a need within the realm of threat detection and management for trusted connections between a machine in a network and a remote server (e.g., a third-party investigating server). To that end, a method is provided for monitoring a network (e.g., establishing trusted communication channels, performing searches and/or forensic investigation for security threats, etc.), where the network comprises a collection of machines that forms a linear communication orbit. The method is performed at a respective machine in the collection of machines. The respective machine receives at a first time a first query through the linear communication orbit, where the first query has been propagated from a respective server (e.g., the third-party investigating server) to the respective machine through one or more upstream machines, upstream of the respective machine, along the linear communication orbit, and the first query includes a set of one or more rules. In response to receiving the first query, the respective machine identifies, for each respective rule in the set of one or more rules, files (e.g., files stored at the respective machine) that contain file content that satisfies the respective rule. Subsequent to receiving the first query, the respective rule generates a first report identifying, for each rule in the set of one or more rules, a count of files at the respective machine that contain file content satisfying the rule. The respective machine then sends the first report through the linear communication orbit to the respective server via an end machine of the linear communication orbit. At a second time, subsequent to the first time, the respective machine receives an instruction packet from an external machine (e.g., external to the linear communication orbit) via the linear communication orbit. Unless the respective machine is at the head node of the linear communication orbit, the instruction packet is propagated to the respective machine through the one or more upstream machines along the linear communication orbit. The instruction packet includes an instruction for establishing a direct duplex connection between the respective machine and the external machine. In response to receiving the instruction packet through the linear communication orbit, the respective machine sends an outbound connection request to the external machine to establish the direct duplex connection between the respective machine and the external machine in accordance with a respective network connection protocol. The respective machine sends to the external machine, via the direct duplex connection, a second report including file identifying information identifying files at the respective machine that contain file content satisfying each rule in the set of one or more rule.

In some embodiments, the method includes receiving, at a third time subsequent to the second time, a second query through the direct duplex connection from the external machine, wherein the second query comprises one or more requests for snippets of information from a respective file identified as containing file content satisfying a respective rule in the set of one or more rules. In response to receiving the second query, the method includes sending to the external machine via the duplex direct connection a third report including one or more snippets corresponding to file content in the respective file that contributes to satisfaction of the respective rule.

In some embodiments, the third report includes snippet information identifying, for the respective file, locations in the respective file corresponding to the file content that contributes to satisfaction of the respective rule.

In some embodiments, the direct duplex connection is an encrypted communication connection in which information sent by the respective machine to the external machine is encrypted (e.g., to protect confidential information).

In some embodiments, the first query includes a single rule, the single rule specifying a string, represented by a sequence of hashed tokens, each hashed token corresponding to a predefined unit of text. Each of the hashed tokens comprises a result of applying a predefined one-way hash function to a corresponding token. The first report includes information corresponding to a count of files at the respective machine that contain file content matching the string specified by the single rule.

In some embodiments, identifying files that contain file content that satisfies the single rule includes performing lookups, in a reverse lookup table, of the hashed tokens in the sequence of hashed tokens, to identify files having content matching units of text in the string specified by the single rule.

In some embodiments, each rule in the set of one or more rules includes a primary rule, and a respective rule in the set of one or more rules includes one or more validation rules that are logically combined with the primary rule of the respective rule to determine whether respective file content (e.g., one or more hits in the respective file) satisfies the respective rule.

In some embodiments, the one or more validation rules of the respective rule include one or more positive validation rules, and determining whether a respective file satisfies the respective rule includes determining a number of hits in the respective file, each hit corresponding to file content in the respective file that satisfies both the primary rule of the respective rule and at least one positive validation rule of the respective rule.

In some embodiments, the one or more validation rules of the respective rule include one or more positive validation rules, and determining whether a respective file satisfies the respective rule includes determining whether file content within the respective file satisfies at least one positive validation rule in the one or more positive validation rules.

In some embodiments, the one or more validation rules of the respective rule include one or more negative validation rules, and determining whether a respective file satisfies the respective rule includes determining a number of hits in the respective file, each hit corresponding to file content in the respective file that satisfies the primary rule of the respective rule and does not satisfy any negative validation rule in the one or more negative validation rules of the respective rule.

In some embodiments, the one or more validation rules of the respective rule include one or more negative validation rules, and the method includes determining whether a respective file does not satisfy the respective rule, including determining whether file content within the respective file satisfies at least one negative validation rule in the one or more negative validation rules.

In some embodiments, the first report is stored in a local database of the respective machine prior to receiving the first query, and the second report is stored in the local database of the respective machine prior to receiving the second query.

In some embodiments, the external machine is the respective server.

In some embodiments, the primary rule of each rule in the set of one or more rules corresponds to a respective regular expression (e.g. a content pattern). However, in some embodiments, each primary rule includes a content pattern, of which regular expressions are a subset.

In some embodiments, a respective rule in the set of one or more rules includes executable instructions, or a reference to executable instructions, for determining if content matching the regular expression of the corresponding primary rule satisfies additional criteria required for satisfying the respective rule.

In some embodiments, the method includes receiving and responding to, via the linear communication orbit, a third query, wherein the third query includes an updated version of at least one rule in the set of one or more rules.

In some embodiments, a computer system (e.g., machine102, administrator's device116, server108and/or server110,FIGS. 1A-1B,FIGS. 7-9) includes one or more processors and memory storing one or more programs for execution by the one or more processors, the one or more programs include instructions for performing, or controlling performance of, the operations of any of the methods described herein.

In some embodiments, a non-transitory computer readable storage medium stores one or more programs, the one or more programs comprising instructions, which, when executed by a computer system (e.g., machine102, administrator's device116, server108and/or server110,FIGS. 1A-1B,FIGS. 7-9) with one or more processors, cause the computer system to perform, or control performance of, the operations of any of the methods described herein.

In some embodiments, a computer system (e.g., machine102, administrator device116, server108and/or server110,FIGS. 1A-1B,FIGS. 7-9) includes means for performing, or controlling performance of, the operations of any of the methods described herein.

Other embodiments and advantages will be apparent to those skilled in the art in light of the descriptions and drawings in this specification.

