System for distributing virtual entity behavior profiling in cloud deployments
First Claim
1. A system, comprising:
- a memory that stores instructions;
a processor that executes the instructions to perform operations, the operations comprising;
accessing, at a hypervisor server, a log including data associated with activities performed by a virtual machine executing on the hypervisor server, wherein the activities are performed by the virtual machine during a first time period, wherein the log including the data associated with the activities performed by the virtual machine is accessed at the hypervisor server without the system transferring the log to a central processing system, thereby reducing bandwidth consumption of the system, wherein the hypervisor server is located in a same server that the log including the data is generated so as to enable faster processing of the data in the log when compared to processing the data in the log at the central processing system;
compressing and encoding the data associated with activities performed by the virtual machine into a format only usable by a behavior profiling algorithm;
executing, by utilizing the hypervisor server, the behavior profiling algorithm on the data associated with the activities performed by the virtual machine, wherein executing the behavior profiling algorithm on the data comprises comparing a historical behavior profile for the virtual machine for a second time period to the data associated with the activities performed by the virtual machine during the first time period;
determining, by utilizing the hypervisor server, if a change in behavior for the virtual machine has occurred based on executing the behavior profiling algorithm on the data associated with the activities performed by the virtual machine, wherein the change in behavior of the virtual machine is determined to have occurred based on detecting a change in a type of connection made by the virtual machine during the first time period when compared with the historical behavior profile for the second time period and based on detecting a change in an efficiency of processing conducted by the virtual machine during the first time period when compared to the historical behavior profile for the second time period; and
generating, if the change in behavior is determined to have occurred and if the change in behavior exceeds a threshold, a report including the data associated with the activities performed by the virtual machine.
1 Assignment
0 Petitions
Accused Products
Abstract
A system for distributing virtual entity behavior profiling in cloud deployments is disclosed. In particular, the system may include conducting entity behavior profiling closer to where data and data logs are generated, such as at a hypervisor server, in a distributed fashion. By doing so, the system may reduce bandwidth consumption typically associated with transferring data to a central processing system, may be able to use more data collected closer to sources of data generation, and may provide faster reaction times because of the faster processing of data enabled by the system. Additionally, the system may assist with reducing false positives associated with malware detection and other compromises associated with entities by aggregating the results of distributed computations at different sites.
-
Citations
20 Claims
-
1. A system, comprising:
-
a memory that stores instructions; a processor that executes the instructions to perform operations, the operations comprising; accessing, at a hypervisor server, a log including data associated with activities performed by a virtual machine executing on the hypervisor server, wherein the activities are performed by the virtual machine during a first time period, wherein the log including the data associated with the activities performed by the virtual machine is accessed at the hypervisor server without the system transferring the log to a central processing system, thereby reducing bandwidth consumption of the system, wherein the hypervisor server is located in a same server that the log including the data is generated so as to enable faster processing of the data in the log when compared to processing the data in the log at the central processing system; compressing and encoding the data associated with activities performed by the virtual machine into a format only usable by a behavior profiling algorithm; executing, by utilizing the hypervisor server, the behavior profiling algorithm on the data associated with the activities performed by the virtual machine, wherein executing the behavior profiling algorithm on the data comprises comparing a historical behavior profile for the virtual machine for a second time period to the data associated with the activities performed by the virtual machine during the first time period; determining, by utilizing the hypervisor server, if a change in behavior for the virtual machine has occurred based on executing the behavior profiling algorithm on the data associated with the activities performed by the virtual machine, wherein the change in behavior of the virtual machine is determined to have occurred based on detecting a change in a type of connection made by the virtual machine during the first time period when compared with the historical behavior profile for the second time period and based on detecting a change in an efficiency of processing conducted by the virtual machine during the first time period when compared to the historical behavior profile for the second time period; and generating, if the change in behavior is determined to have occurred and if the change in behavior exceeds a threshold, a report including the data associated with the activities performed by the virtual machine. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13)
-
-
14. A method, comprising:
-
accessing, at a hypervisor server, a log including data associated with activities performed by a virtual machine executing on the hypervisor server, wherein the activities are performed by the virtual machine during a first time period, wherein the log including the data associated with the activities performed by the virtual machine is accessed at the hypervisor server without the system transferring the log to a central processing system, thereby reducing bandwidth consumption of the system, wherein the hypervisor server is located in a same server that the log including the data is generated so as to enable faster processing of the data in the log when compared to processing the data in the log at the central processing system; compressing and encoding the data associated with activities performed by the virtual machine into a format only usable by a behavior profiling algorithm; executing, by utilizing the hypervisor server, the behavior profiling algorithm on the data associated with the activities performed by the virtual machine, wherein executing the behavior profiling algorithm on the data comprises comparing a historical behavior profile for the virtual machine for a second time period to the data associated with the activities performed by the virtual machine during the first time period; determining, by utilizing instructions from a memory that are executed by a processor and by utilizing the hypervisor server, if a change in behavior for the virtual machine has occurred based on executing the behavior profiling algorithm on the data associated with the activities performed by the virtual machine, wherein the change in behavior of the virtual machine is determined to have occurred based on detecting a change in a type of connection made by the virtual machine during the first time period when compared with the historical behavior profile for the second time period and based on detecting a change in an efficiency of processing conducted by the virtual machine during the first time period when compared to the historical behavior profile for the second time period; and generating, if the change in behavior is determined to have occurred and if the change in behavior exceeds a threshold, a report including the data associated with the activities performed by the virtual machine. - View Dependent Claims (15, 16, 17, 18, 19)
-
-
20. A computer-readable device comprising instructions, which when executed by a processor, cause the processor to perform operations comprising:
-
accessing, at a hypervisor server, a log including data associated with activities performed by a virtual machine executing on the hypervisor server, wherein the activities are performed by the virtual machine during a first time period, wherein the log including the data associated with the activities performed by the virtual machine is accessed at the hypervisor server without the system transferring the log to a central processing system, thereby reducing bandwidth consumption of the system, wherein the hypervisor server is located in a same server that the log including the data is generated so as to enable faster processing of the data in the log when compared to processing the data in the log at the central processing system; compressing and encoding the data associated with activities performed by the virtual machine into a format only usable by a behavior profiling algorithm; executing, by utilizing the hypervisor server, the behavior profiling algorithm on the data associated with the activities performed by the virtual machine, wherein executing the behavior profiling algorithm on the data comprises comparing a historical behavior profile for the virtual machine for a second time period to the data associated with the activities performed by the virtual machine during the first time period; determining, by utilizing the hypervisor server, if a change in behavior for the virtual machine has occurred based on executing the behavior profiling algorithm on the data associated with the activities performed by the virtual machine, wherein the change in behavior of the virtual machine is determined to have occurred based on detecting a change in a type of connection made by the virtual machine during the first time period when compared with the historical behavior profile for the second time period and based on detecting a change in an efficiency of processing conducted by the virtual machine during the first time period when compared to the historical behavior profile for the second time period; and generating, if the change in behavior is determined to have occurred and if the change in behavior exceeds a threshold, a report including the data associated with the activities performed by the virtual machine.
-
Specification