Computer implemented techniques for detecting, investigating and remediating security violations to IT infrastructure

• US 10,375,101 B2
• Filed: 03/07/2016
• Issued: 08/06/2019
• Est. Priority Date: 03/13/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Berger, Stefan, Chen, Yangyi, Hu, Xin, Pendarakis, Dimitrious, Rao, Josyula, Sailer, Reiner, Schales, Douglas Lee, Stoecklin, Marc
• Primary Examiner(s): Steinle, Andrew J
• Application Number:
  US15/062,374
• Publication Number:
  US 20160261624A1
• Time in Patent Office: 1,247 Days
• Field of Search: None
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method includes collecting system calls and call parameters invoked by monitored applications for target computer systems. The system calls and call parameters are received from operating system kernels on the plurality of target computer systems. Sequences of systems calls and call parameters of the monitored applications are correlated among different target computer systems to deduce malicious activities. Remedial action(s) are performed in response to malicious activities being deduced as being malicious by the correlating. Another method includes determining that network activity at a specific time is deemed to be suspicious. Using IP addresses involved in the suspicious network activity, computer system(s) are determined that are sources of the suspicious network activity. Based on the specific time and the determined computer system(s), application(s) are determined that are executing on the determined computer system(s) that are causing the suspicious network activity. Remedial action(s) are performed for the determined computer system(s).

Claims

1. A method, comprising:

determining that network activity in an infrastructure at a specific time is deemed to be suspicious based at least on network activity as observed on switches in the infrastructure;

determining, using Internet protocol addresses involved in the suspicious network activity observed on one or more of the switches, one or more computer systems in the infrastructure that are sources of the suspicious network activity,

determining, based on the specific time and the determined one or more computer systems, one or more applications executing on the one or more determined computer systems in the infrastructure that are causing the suspicious network activity to be observed at least by determining which applications from the one or more determined computer systems were causing the network traffic at the specific time, and determining which applications were causing network traffic at the specific time is based on collected system calls and call parameters for system calls that were performed by the one or more determined computer systems and is based on corresponding timestamps indicating when the system calls were invoked, where operating system kernels on the one or more determined computer systems have been instrumented via code instructions in the operating system kernels to report at least the system calls and call parameters invoked by monitored applications;

determining whether any collected events and measurements corresponding to the one or more applications are considered significant for analysis;

analyzing any collected events and measurements determined to be significant for analysis to determine whether a security violation has occurred for any of the one or more applications; and

causing, in response to a security violation being deemed to have occurred for at least one of the one or more applications, one or more remedial actions to be performed for the determined one or more computer systems that correspond to the at least one application.

2. The method of claim 1, wherein at least one of the determined one or more computer systems comprises a virtual machine and wherein causing the one or more remedial actions to be performed further comprises causing the virtual machine to be placed in a quarantine network.

3. The method of claim 1, wherein at least one of the determined one or more computer systems comprises a virtual machine and wherein causing the one or more remedial actions to be performed further comprises causing the virtual machine to be paused.

4. The method of claim 1, wherein at least one of the determined one or more computer systems comprises a virtual machine and wherein causing the one or more remedial actions to be performed further comprises causing the virtual machine to be shutdown.

5. The method of claim 1, wherein at least one of the determined one or more computer systems comprises a particular computer system and wherein performing one or more remedial actions further comprises causing the particular computer system to be isolated at least by causing blocking of network traffic to and from the particular computer system.

6. The method of claim 1, wherein:

the method further comprises displaying on a display of a particular computer system network activity as observed on switches for a plurality of computer systems;

the determining that network activity at a specific time is deemed to be suspicious based at least on network activity as observed on switches is performed by an administrator based at least on the displayed network activity observed on the one or more switches;

the method further comprises displaying on the display of the particular computer system Internet protocol addresses determined to be involved in the suspicious network activity observed on the one or more switches;

the determining one or more computer systems that are sources of the suspicious network activity is performed by the administrator or automatically by an analytics application based on the determined Internet protocol addresses involved in the suspicious network activity,

the method further comprises displaying on the display of the particular computer system a plurality of applications executing on the one or more determined computer systems, the displaying using the collected system calls for the one or more determined computer systems;

the determining one or more applications executing on the one or more computer systems that are causing the network activity is performed by an administrator using the displayed plurality of applications executing on the one or more computer systems; and

causing one or more remedial actions to be performed for the one or more computer systems is performed by the particular computer system, responsive to input from the administrator.

7. The method of claim 1, wherein a specific computer system performs the determining that network activity at a specific time is deemed to be suspicious, the determining one or more computer systems that are sources of the suspicious network activity, the determining the one or more applications executing on the one or more computer systems that are causing the network activity, and the causing one or more remedial actions to be performed for the one or more computer systems.

8. The method of claim 1, wherein using security information external to the infrastructure to determine significance of the collected events and measurements further comprises one or more of the following:

comparing Internet protocol/domain blacklists against network connections created by determined one or more computer systems having the one or more applications;

comparing external file blacklists to assess file creation activities or file modification activities or both file creation and file modification activities by the one or more applications; and

using software vulnerability reports to evaluate the one or more applications.

9. The method of claim 1, wherein using security information external to the infrastructure to determine significance of the collected events and measurements further comprises using a whitelist comprising indications of applications that have been deemed to have no security violations to evaluate the one or more applications.

10. An apparatus, comprising:

one or more processors; and

one or more memories comprising computer readable code,

wherein the one or more processors, in response to execution of the computer program code, cause the apparatus to perform at least the following;

determining that network activity in an infrastructure at a specific time is deemed to be suspicious based at least on network activity as observed on switches in the infrastructure;

determining, using Internet protocol addresses involved in the suspicious network activity observed on one or more of the switches, one or more computer systems in the infrastructure that are sources of the suspicious network activity;

determining, based on the specific time and the determined one or more computer systems, one or more applications executing on the one or more determined computer systems in the infrastructure that are causing the suspicious network activity to be observed at least by determining which applications from the one or more determined computer systems were causing network traffic at the specific time, and determining which applications were causing network traffic at the specific time is based on collected system calls and call parameters for system calls that were performed by the one or more determined computer systems and is based on corresponding timestamps indicating when the system calls were invoked, where operating system kernels on the one or more determined computer systems have been instrumented via code instructions in the operating system kernels to report at least the system calls and call parameters invoked by monitored applications;

determining whether any collected events and measurements corresponding to the one or more applications are considered significant for analysis;

analyzing any collected events and measurements determined to be significant for analysis to determine whether a security violation has occurred for any of the one or more applications; and

causing, in response to a security violation being deemed to have occurred for at least one of the one or more applications, one or more remedial actions to be performed for the determined one or more computer systems that correspond to the at least one application.

11. The apparatus of claim 10, wherein at least one of the determined one or more computer systems comprises a virtual machine and wherein causing the one or more remedial actions to be performed further comprises causing the virtual machine to be placed in a quarantine network.

12. The apparatus of claim 10, wherein at least one of the determined one or more computer systems comprises a virtual machine and wherein causing the one or more remedial actions to be performed further comprises causing the virtual machine to be paused.

13. The apparatus of claim 10, wherein at least one of the determined one or more computer systems comprises a virtual machine and wherein causing the one or more remedial actions to be performed further comprises causing the virtual machine to be shutdown.

14. The apparatus of claim 10, wherein at least one of the determined one or more computer systems comprises a particular computer system and wherein performing one or more remedial actions further comprises causing the particular computer system to be isolated at least by causing blocking of network traffic to and from the particular computer system.

15. The apparatus of claim 10, wherein:

wherein the one or more processors, in response to execution of the computer program code, further cause the apparatus to perform displaying on a display of a particular computer system network activity as observed on switches for a plurality of computer systems to select the one or more switches;

the determining that network activity at a specific time is deemed to be suspicious based at least on network activity as observed on switches is performed by an administrator based at least on the displayed network activity observed on the one or more switches;

wherein the one or more processors, in response to execution of the computer program code, further cause the apparatus to perform displaying on the display of the particular computer system Internet protocol addresses determined to be involved in the suspicious network activity observed on the one or more switches;

the determining one or more computer systems that are sources of the suspicious network activity is performed by the administrator or automatically by an analytics application based on the determined Internet protocol addresses involved in the suspicious network activity,

wherein the one or more processors, in response to execution of the computer program code, further cause the apparatus to perform displaying on the display of the particular computer system a plurality of applications executing on the one or more determined computer systems, the displaying using the collected system calls for the one or more determined computer systems;

the determining one or more applications executing on the one or more computer systems that are causing the network activity is performed by an administrator using the displayed plurality of applications executing on the one or more computer systems; and

causing one or more remedial actions to be performed for the one or more computer systems is performed by the particular computer system, responsive to input from the administrator.

16. The apparatus of claim 10, wherein a specific computer system performs the determining that network activity at a specific time is deemed to be suspicious, the determining one or more computer systems that are sources of the suspicious network activity, the determining the one or more applications executing on the one or more computer systems that are causing the network activity, and the causing one or more remedial actions to be performed for the one or more computer systems.

17. A computer program product, comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by an apparatus comprising one or more processors to cause the apparatus to perform at least the following:

determining that network activity in an infrastructure at a specific time is deemed to be suspicious based at least on network activity as observed on switches in the infrastructure;

determining, using Internet protocol addresses involved in the suspicious network activity observed on one or more of the switches, one or more computer systems in the infrastructure that are sources of the suspicious network activity;

determining, based on the specific time and the determined one or more computer systems, one or more applications executing on the one or more determined computer systems in the infrastructure that are causing the suspicious network activity to be observed at least by determining which applications from the one or more determined computer systems were causing network traffic at the specific time, and determining which applications were causing network traffic at the specific time is based on collected system calls and call parameters for system calls that were performed by the one or more determined computer systems and is based on corresponding timestamps indicating when the system calls were invoked, where operating system kernels on the one or more determined computer systems have been instrumented via code instructions in the operating system kernels to report at least the system calls and call parameters invoked by monitored applications;

determining whether any collected events and measurements corresponding to the one or more applications are considered significant for analysis;

analyzing any collected events and measurements determined to be significant for analysis to determine whether a security violation has occurred for any of the one or more applications; and

causing, in response to a security violation being deemed to have occurred for at least one of the one or more applications, one or more remedial actions to be performed for the determined one or more computer systems that correspond to the at least one application.

18. The computer program product of claim 17, wherein at least one of the determined one or more computer systems comprises a virtual machine and wherein causing the one or more remedial actions to be performed further comprises one of causing the virtual machine to be placed in a quarantine network, causing the virtual machine to be paused, or causing the virtual machine to be shutdown.

19. The computer program product of claim 17, wherein at least one of the determined one or more computer systems comprises a particular computer system and wherein performing one or more remedial actions further comprises causing the particular computer system to be isolated at least by causing blocking of network traffic to and from the particular computer system.

20. The computer program product of claim 17,

the program instructions executable by the apparatus further cause the apparatus to perform displaying on a display of a particular computer system network activity as observed on switches for a plurality of computer systems;

the determining that network activity at a specific time is deemed to be suspicious based at least on network activity as observed on switches is performed by an administrator based at least on the displayed network activity observed on the one or more switches;

the program instructions executable by the apparatus further cause the apparatus to perform displaying on the display of the particular computer system Internet protocol addresses determined to be involved in the suspicious network activity observed on the one or more switches;

the determining one or more computer systems that are sources of the suspicious network activity is performed by the administrator or automatically by an analytics application based on the determined Internet protocol addresses involved in the suspicious network activity;

the program instructions executable by the apparatus further cause the apparatus to perform displaying on the display of the particular computer system a plurality of applications executing on the one or more determined computer systems, the displaying using the collected system calls for the one or more determined computer systems;

the determining one or more applications executing on the one or more computer systems that are causing the network activity is performed by an administrator using the displayed plurality of applications executing on the one or more computer systems; and

causing one or more remedial actions to be performed for the one or more computer systems is performed by the particular computer system, responsive to input from the administrator.