Security agent

• US 10,002,250 B2
• Filed: 12/29/2016
• Issued: 06/19/2018
• Est. Priority Date: 06/08/2012
• Status: Active Grant

• Current Assignee: Crowdstrike, Inc. (CrowdStrike Holdings Incorporated)
• Original Assignee: Crowdstrike, Inc. (CrowdStrike Holdings Incorporated)
• Inventors: Diehl, David F., Alperovitch, Dmitri, Ionescu, Ion-Alexandru, Kurtz, George Robert
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US15/393,797
• Publication Number:
  US 20170109530A1
• Time in Patent Office: 537 Days
• Field of Search: None
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/46 Multiprogramming arrangements
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A security agent is described herein. The security agent is configured to observe events, filter the observed events using configurable filters, route the filtered events to one or more event consumers, and utilize the one or more event consumers to take action based at least on one of the filtered events. In some implementations, the security agent detects a first action associated with malicious code, gathers data about the malicious code, and in response to detecting subsequent action(s) of the malicious code, performs a preventative action. The security agent may also deceive an adversary associated with malicious code. Further, the security agent may utilize a model representing chains of execution activities and may take action based on those chains of execution activities.

Claims

1. A computer-implemented method comprising:

detecting a first action associated with malicious code;

responsive to detecting the first action, while refraining from taking a preventative action, gathering data associated with the first action;

subsequently, detecting one or more subsequent actions associated with malicious code, the one or more subsequent actions occurring after the first action; and

in response to detecting the first action and the one or more subsequent actions, performing the preventative action.

2. The method of claim 1, wherein the preventative action comprises preventing the one or more subsequent actions and further actions by the malicious process or deceiving an adversary associated with the malicious code.

3. The method of claim 1, further comprising storing the gathered data in a model that tracks actions taken by processes of a system which executed the first action.

4. The method of claim 3, further comprising:

observing execution activities of the processes, the execution activities of the one or more processes comprising the first action and the one or more subsequent actions;

storing data associated with the one or more execution activities in the model, the model representing one or more chains of execution activities; and

performing the preventative action further based at least in part on the one or more chains of execution activities.

5. The method of claim 1, further comprising providing the gathered data to a remote security system.

6. The method of claim 5, further comprising, after providing the gathered data to the remote security system, receiving, from the remote security system, at least one of:

instructions associated with the preventative action;

or

a configuration update for configuring a security agent that performs the detecting, gathering, and performing.

7. The method of claim 6, further comprising:

receiving the configuration update comprising a configuration of a configurable filter; and

detecting a second action associated with malicious code based at least in part on the configurable filter.

8. The method of claim 1, wherein the detecting, gathering, and performing are performed by a kernel-level security agent that utilizes configurable filters.

9. The method of claim 1, wherein detecting the first action or the one or more subsequent actions comprises observing events associated with multiple processes or threads in parallel.

10. One or more tangible computer-readable storage devices storing computer-executable instructions configured to implement a security agent on a computer device, the security agent performing operations comprising:

observing an event associated with a process executing on the computing device;

determining, based at least in part on the observed event and on a model that tracks processes of the computing device, that the process is associated with malicious code wherein the determining comprises;

observing execution activities of one or more processes of the computing device, the one or more processes including the process and the execution activities including the event; and

storing data associated with the one or more execution activities in the model, the model representing one or more chains of execution activities; and

responsive to the determining, deceiving an adversary associated with the malicious code based at least in part on the one or more chains of execution activities.

11. The one or more tangible computer-readable storage devices of claim 10, wherein the deceiving comprises falsifying data acquired by the malicious code.

12. The one or more tangible computer-readable storage devices of claim 10, wherein the deceiving comprises falsifying the data transmitted to the adversary.

13. The one or more tangible computer-readable storage devices of claim 10, wherein the security agent utilizes configurable filters.

14. The one or more tangible computer-readable storage devices of claim 10, wherein the operations further comprise providing gathered data associated with the observed event to a remote security system.

15. The one or more tangible computer-readable storage devices of claim 14, wherein the operations further comprise, after providing the gathered data to the remote security system, receiving, from the remote security system, at least one of:

instructions associated with the preventative action;

or

a configuration update for configuring a security agent that performs the detecting, gathering, and performing.

16. The one or more tangible computer-readable storage devices of claim 10, wherein the operations further comprise preventing an action by the process.

17. A method implemented by a security agent of a computing device, the method comprising:

observing execution activities of at least two processes of the computing device;

storing first data associated with a first execution activity of the execution activities in a model of the security agent;

storing second data associated with a second execution activity of the execution activities in the model of the security agent, wherein;

the model represents one or more chains of execution activities;

the one or more chains of execution activities comprise a first chain of execution activities; and

the first chain of execution activities comprises the first data and the second data; and

taking action based at least in part on the first chain of execution activities.

18. The method of claim 17, wherein at least one of the chains of execution activities represents a genealogy of one of the processes.

19. The method of claim 17, wherein the taking action comprises halting or deceiving a process of the at least two processes, the process being associated with malicious activity.

20. The method of claim 17, further comprising providing at least some of the stored data to a remote security system.

21. The method of claim 20, further comprising receiving, in response to providing the at least some of the stored data to the remote security system, instructions associated with the action or a configuration update for configuring the security agent.

22. The method of claim 21, further comprising:

receiving the configuration update comprising a configuration of a configurable filter; and

observing an execution activity based at least in part on the configurable filter.

23. The method of claim 17, wherein the security agent utilizes configurable filters.