Method and system for enabling self-monitoring virtual assets to correlate external events with characteristic patterns associated with the virtual assets

• US 10,055,247 B2
• Filed: 11/21/2016
• Issued: 08/21/2018
• Est. Priority Date: 04/18/2014
• Status: Active Grant

• Current Assignee: Intuit, Inc.
• Original Assignee: Intuit, Inc.
• Inventors: Cabrera, Luis Felipe, Lietz, M. Shannon
• Primary Examiner(s): Potratz, Daniel B
• Application Number:
  US15/356,985
• Publication Number:
  US 20170068563A1
• Time in Patent Office: 638 Days
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 41/0886 Fully automatic configuration
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5025 by proactively reacting to service quality change, e.g. by reconfiguration after service quality degradation or upgrade
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

External events are correlated with patterns of characteristics in virtual assets. Upon detection of a pattern in a different asset that matches a pattern corresponding to an event, that detection is treated as a trigger event, with resulting responsive action(s) and other process operations. Security threats are managed in a similar manner, with first security threats being added to a collection of security threats. When a virtual asset detects a change in operating characteristics, a request is provided for the collection of current security threats, and the collection of security threats is provided responsive to the request.

Claims

1. A computing system implemented method for enabling self-monitoring virtual assets to correlate external events with characteristic patterns associated with the virtual assets, comprising:

receiving, at a first computing environment from one or more electronic sources external to the first computing environment, data identifying one or more external events currently occurring wherein the external events include at least one of a natural disaster, and a world event;

receiving first patterns from one or more first virtual assets providing one or more computing services to one or more users, each of the one or more first virtual assets including an allocation of one or more hardware and software resources from a second computing environment, the first patterns representing operational characteristics of the first virtual assets and generated by the one or more first virtual assets during the occurrence of a respective external event of the one or more external events;

learning, by populating a database with the first patterns and the data identifying the respective external events, a correlation between external events to first patterns representing a deviation from a normal operating parameter as a result of an occurrence of the respective external events at the time of the deviation;

providing a virtual asset monitoring system;

defining one or more trigger events to be reported when detected in a virtual asset, at least one defined trigger event being a detection, in a virtual asset, of a pattern in the virtual asset matching a first pattern of the database representing a deviation from a normal operating parameter as a result of an occurrence of an external event;

generating virtual asset self-monitoring logic representing instructions for detecting the one or more trigger events within a virtual asset;

generating virtual asset self-reporting logic representing instructions for generating trigger event reporting data indicating a detected trigger event if one of the one or more trigger events is detected in a virtual asset;

generating virtual asset self-reporting communications channel creation logic representing instructions for opening a self-reporting communications channel between a virtual asset and the virtual asset monitoring system upon detection of one or more trigger events in a virtual asset;

instantiating a second virtual asset, the second virtual asset including, at instantiation, the virtual asset self-monitoring logic, the virtual asset self-reporting logic, and the virtual asset self-reporting communications channel creation logic;

detecting, in the second virtual asset, a trigger event of the one or more trigger events, the detected trigger event being a detection, in the second virtual asset, of a pattern in the second virtual asset matching a first asset pattern representing a deviation from a normal operating parameter as a result of an occurrence of an external event, the pattern in the second virtual asset representing second operational characteristics of the second virtual asset that represent deviations by the second virtual asset from predetermined live operational characteristics determined from an exemplary operational virtual asset;

generating, by the second virtual asset, trigger event reporting data indicating the detected trigger event has been detected;

generating, by the second virtual asset, a self-reporting communications channel between the second virtual asset and the virtual asset monitoring system; and

transferring, by the second virtual asset over the self-reporting communications channel, the trigger event reporting data.

2. The method of claim 1, wherein the natural disaster includes one or more of a hurricane, a tornado, an earthquake, a tsunami, a typhoon, a volcano, and a flood.

3. The method of claim 1, wherein the world event includes one or more of a sporting event, an election, an act of terrorism, and a war.

4. The method of claim 1, the external events further including a malicious software attack and

wherein the malicious software attack includes one or more of a denial of service attack, a virus, a worm, a Trojan horse, spoofing, and pharming.

5. The method of claim 1, wherein the first and second operational characteristics include one or more characteristics selected from a group of characteristics including one or more types of messages received, quantities of messages received, geographic origins of messages received, frequencies of messages received, size of messages received, failed user account login attempts, processor usage percentages, denied access to a third computing environment, memory usage percentages, and network bandwidth.

6. The method of claim 1, wherein each of the one or more second virtual assets provides the one or more computing services to the one or more users,

wherein each of the one or more second virtual assets includes an second allocation of one or more second hardware and software resources from a third computing environment.

7. The method of claim 1 wherein the second virtual asset is a virtual asset selected from the group of the virtual assets consisting of:

a virtual machine;

a virtual server;

a database or data store;

an instance in a cloud environment;

a cloud environment access system;

part of a mobile device;

part of a remote sensor;

part of a server computing system; and

part of a desktop computing system.

8. The method of claim 1 wherein at least one of the one or more external events is selected from the group of external events consisting of:

a response to a customer request being directed to a destination that is not the customer location of record;

a virtual asset receiving a high-frequency of login attempts that fail;

a total amount of data in any one communication connection of a virtual asset exceeding a defined maximum;

a request to a virtual asset coming in from a location known to be associated with malicious entities; and

an internal elapsed time of defined critical operations changing to a time outside a defined range.

9. The method of claim 1, wherein the one or more electronic sources include websites or web-interfaces to one or more government agencies, media companies, and computing security companies.

10. The method of claim 1, further comprising:

determining if each of the one or more electronic sources satisfies a minimum threshold of trust, wherein receiving the identification of one of the external events includes receiving the identification, from the one or more electronic sources that satisfy the minimum threshold of trust.

11. The method of claim 1, further comprising:

increasing a number of the one or more electronic sources to enable improved verification of occurrences of the external events.

12. A system for correlating virtual asset patterns with external events, the system comprising:

at least one computing processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which, when executed by any set of the at least one computing processors, perform a process for correlating virtual asset patterns with external events, the process including;

receiving, at a first computing environment from one or more electronic sources external to the first computing environment, data identifying one or more external events currently occurring wherein the external events include at least one of a natural disaster, and a world event;

receiving first patterns from one or more first virtual assets providing one or more computing services to one or more users, each of the one or more first virtual assets including an allocation of one or more hardware and software resources from a second computing environment, the first patterns representing operational characteristics of the first virtual assets and generated by the one or more first virtual assets during the occurrence of a respective external event of the one or more external events;

learning, by populating a database with the first patterns and the data identifying the respective external events, a correlation between external events to first patterns representing a deviation from a normal operating parameter as a result of an occurrence of the respective external events at the time of the deviation;

providing a virtual asset monitoring system;

defining one or more trigger events to be reported when detected in a virtual asset, at least one defined trigger event being a detection, in a virtual asset, of a pattern in the virtual asset matching a first pattern of the database representing a deviation from a normal operating parameter as a result of an occurrence of an external event;

generating virtual asset self-monitoring logic representing instructions for detecting the one or more trigger events within a virtual asset;

generating virtual asset self-reporting logic representing instructions for generating trigger event reporting data indicating a detected trigger event if one of the one or more trigger events is detected in a virtual asset;

generating virtual asset self-reporting communications channel creation logic representing instructions for opening a self-reporting communications channel between a virtual asset and the virtual asset monitoring system upon detection of one or more trigger events in a virtual asset;

instantiating a second virtual asset, the second virtual asset including, at instantiation, the virtual asset self-monitoring logic, the virtual asset self-reporting logic, and the virtual asset self-reporting communications channel creation logic;

detecting, in the second virtual asset, a trigger event of the one or more trigger events, the detected trigger event being a detection, in the second virtual asset, of a pattern in the second virtual asset matching a first asset pattern representing a deviation from a normal operating parameter as a result of an occurrence of an external event, the pattern in the second virtual asset representing second operational characteristics of the second virtual asset that represent deviations by the second virtual asset from predetermined live operational characteristics determined from an exemplary operational virtual asset;

generating, by the second virtual asset, trigger event reporting data indicating the detected trigger event has been detected;

generating, by the second virtual asset, a self-reporting communications channel between the second virtual asset and the virtual asset monitoring system; and

transferring, by the second virtual asset over the self-reporting communications channel, the trigger event reporting data.

13. The system of claim 12, wherein the natural disaster includes one or more of a hurricane, a tornado, an earthquake, a tsunami, a typhoon, a volcano, and a flood.

14. The system of claim 12, wherein the world event includes one or more of a sporting event, an election, an act of terrorism, and a war.

15. The system of claim 12, the external events further including a malicious software attack, and

wherein the malicious software attack includes one or more of a denial of service attack, a virus, a worm, a Trojans horse, spoofing, and pharming.

16. The system of claim 12, wherein the first and second operational characteristics include one or more characteristics selected from a group of characteristics including one or more types of messages received, quantities of messages received, geographic origins of messages received, frequencies of messages received, size of messages received, failed user account login attempts, processor usage percentages, denied access to a third computing environment, memory usage percentages, and network bandwidth.

17. The system of claim 12, wherein each of the one or more second virtual assets provides the one or more computing services to the one or more users,

wherein each of the one or more second virtual assets includes an second allocation of one or more second hardware and software resources from a third computing environment.

18. The system of claim 12, wherein the one or more electronic sources include websites or web-interfaces to one or more government agencies, media companies, and computing security companies.