Methods and apparatus providing security to computer systems and networks

• US 20060156380A1
• Filed: 01/07/2005
• Published: 07/13/2006
• Est. Priority Date: 01/07/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Gladstone, Philip J. S., Kraemer, Jeffrey A.
• Granted Patent: US 7,979,889 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system provides security to a computerized device by detecting a sequence of related processing operations within the computerized device and recording the sequence of related processing operations in a security history. The system identifies a security violation when a processing operation performed in the computerized device produces an undesired processing outcome that violates a security policy and subsequently detecting attempted performance of at least one processing operation that attempts to produce the undesired processing outcome that violates the security policy and in response, denies operation of the processing operation(s) within the computerized device to avoid violation of the security policy.

Claims

1. A method providing security to a computerized device, the method comprising operations of:

detecting a sequence of related processing operations within the computerized device;

recording the sequence of related processing operations in a security history;

identifying a security violation when a processing operation performed in the computerized device produces an undesired processing outcome that violates a security policy; and

subsequently detecting attempted performance of at least one processing operation that attempts to produce the undesired processing outcome that violates the security policy and in response, denying operation of the at least one processing operation within the computerized device to avoid violation of the security policy.

2. The method of claim 1 wherein detecting a sequence of related processing operations within the computerized device comprises:

operating a plurality of security interceptors that detect processing operations of different respective processing activities executing within the computerized device;

generating event data upon detection of processing operations associated with those respective processing activities; and

wherein recording the sequence of related processing operations in a security history comprises;

storing the event data within the security history, the event data indicating a processing operation and an identity of a security interceptor that detected the processing operation.

3. The method of claim 2 wherein identifying a security violation when a processing operation executing in the computerized device produces a undesired processing outcome that violates a security policy comprises:

analyzing the security history to identify at least one processing operation recorded within the security history that indicates an undesired processing outcome within the computer system; and

marking the at least one processing operation within the security history as being at least one processing operation that violates the security policy; and

wherein denying operation of the at least one processing operation within the computerized device to avoid violation of the security policy comprises;

instructing at least one security interceptor that detected the marked at least one processing operation to disallow execution of the at least one marked processing operation within the computerized device.

4. The method of claim 3 wherein analyzing the security history to identify at least one processing operation recorded within the security history that indicates an undesired processing outcome within the computer system comprises:

comparing event data records in the security history to event data records of at least one other security history to identify common processing operations in the event data records of the compared security histories that indicate an undesired processing operation.

5. The method of claim 4 further comprising:

executing the processing instruction that results in the undesired processing outcome within the computer system;

recovering from the undesired processing outcome within the computer system; and

storing an indication of the undesired processing outcome in association with the security history; and

wherein analyzing the security history is performed in response to recovering from the undesired processing outcome.

6. The method of claim 5 wherein comparing event data records in the security history to event data records of at least one other security history to identify common processing operations in the event data records of the compared security histories that indicate an undesired processing operation comprises:

identifying, as the at least one other security history, different security histories that include a same stored indication of the undesired processing outcome; and

comparing each different security history that includes the same stored indication of the undesired processing outcome to identify event data records in each different security history that identify common processing instructions that were executed by a computer system that generated the security history prior to the occurrence of the undesired processing outcome in order to identify a pattern of processing instructions between the different security histories that produces the undesired processing outcome.

7. The method of claim 6 wherein the different security histories are produced over time by a single security agent operating in the computer system and wherein the operations of detecting a sequence of related processing operations, recording the sequence of related processing operations in a security history, identifying a security violation, and denying operation of the at least one processing operation within the computerized device to avoid violation of the security policy are performed locally by the security agent operating on the computer system without requiring updates from a remote computer system.

8. The method of claim 6 comprising:

transferring the security history to a management center computer system coupled via a network to the computerized device;

and wherein the operations involved with identifying a security violation when a processing operation executing in the computerized device produces an undesired processing outcome that violates a security policy are performed remotely by the management center computer system; and

wherein the method comprises;

receiving an updated security policy from the management center computer system, the updated security policy including a newly identified pattern of processing instructions that, if executed by the computer system, would violate the security policy; and

wherein subsequently detecting attempted performance of at least one processing operation that attempts to produce the undesired processing outcome that violates the security policy comprises;

detecting attempted performance of the newly identified pattern of processing instructions.

9. The method of claim 8 wherein subsequently detecting attempted performance of at least one processing operation that attempts to produce the undesired processing outcome that violates the security policy comprises:

comparing event data records in the security history to identify processing instructions in event data records that are known to produce undesired processing outcomes as defined in the security policy.

10. The method of claim 1 wherein the operations of detecting, recording and identifying collectively monitor, record and identify processing operations from executing of a sequence of related calls to software entities within a computer system that result in violation of the security policy for a first time;

and

wherein the operation of subsequently detecting attempted performance of a similar sequence of related processing operations comprises;

detecting attempted performance of the sequence of related calls to software entities within a computer system that, if performance were completed, would result in violation of the security policy a second time; and

wherein denying operation of at least a portion of the sequence of related processing operations within the computerized device to avoid violation of the security policy comprises;

disallowing performance of the sequence of related calls the second time, without requiring modification of the security policy by a management center application outside of the computerized device during a time elapsed from identification of violation of the security policy the first time up to the attempted violation of the security policy by the sequence of related processing operations the second time.

11. The method of claim 10 wherein executing a sequence of related calls to software processes within a computer system that violate the security policy a first time comprises:

executing a series of related system calls that cause an undesired processing outcome within the computer system, the undesired processing outcome being defined in the security policy; and

wherein identifying a security violation when a processing operation executing in the computerized device produces a undesired processing outcome that violates a security policy comprises;

recovering from the undesired processing outcome within the computer system;

analyzing the security history in response to recovering from the undesired processing outcome to identify the sequence of related processing operations that resulted in the undesired processing outcome within the computer system; and

and if the identified sequence of related processing operations is determined to be not part of normal processing operations, marking the sequence of related processing operations and associated processing outcomes within the security history as being a sequence of processing operations that violates the security policy.

12. The method of claim 11 wherein the operations of detecting processing outcomes and recording the processing outcomes are repeated N number of times, where N is an integer greater than 1;

and

wherein recording the processing outcomes and the sequence of related processing operations in a security history comprises;

producing N respective security histories, one for each repeated iteration of the operations of detecting processing outcomes and recording the processing outcomes, and wherein a plurality of the N security histories indicate attempted execution of the sequence of processing operations that violates the security policy; and

wherein analyzing the security history in response to recovering from the undesired processing outcome to identify the sequence of related processing operations that resulted in the undesired processing outcome within the computer system comprises;

correlating those security histories of the N security histories that indicate attempted operation of the sequence of processing operations marked as in violation of the security policy to identify a root common cause of processing operations within each security history that led up to the attempted operation of the sequence of processing operations that violates the security policy; and

adapting the security policy to include the root common cause of processing operations as producing an undesired processing outcome.

13. The method of claim 12 wherein subsequently detecting attempted performance of a similar sequence of related processing operations that attempt to produce at least one undesired processing outcome that violates the security policy comprises:

operating a plurality of security interceptors that monitor operation of different respective processing activities of the computerized device to detect an attempt to perform the root common cause of processing operations identified within each security history that produces an undesired processing outcome; and

wherein denying operation of at least a portion of the sequence of related processing operations within the computerized device to avoid violation of the security policy comprises;

disallowing operation of the root common cause of processing operations to avoid violation of the security policy.

14. The method of claim 4 wherein operating a plurality of security interceptors comprises:

operating at least one network interceptor to monitor processing operations associated with communications of a communications session within the computerized device;

operating at least one operating system interceptor to monitor processing operations associated with execution of an operating system within the computerized device;

operating at least one user space interceptor to monitor processing operations associated with execution of at least one application within the computerized device.

15. The method of claim 14 wherein each of the network interceptor, operating system interceptor and user space interceptor performs operations of:

receiving an instruction to produce an event record upon detection of an attempt to execute a monitored processing operation identified in the security policy;

reporting the event record to an event correlation engine upon detection of an attempt to execute the monitored processing operation; and

prior to execution of the monitored processing operation, receiving an authorization response from the event correlation engine that indicates if execution of the monitored processing operation is to be allowed, and if not, disallowing execution of the monitored processing operation to avoid violation of the security policy.

16. The method of claim 3 wherein analyzing the security history to identify at least one processing operation recorded within the security history that indicates an undesired processing outcome within the computer system comprises:

detecting the at least one processing operation that matches a sequence of instructions related to an undesired processing outcome produced as a result of at least one of;

a virus attack, a worm attack, a Trojan horse attack, a Denial-of-service attack, a Buffer overflows operation, execution of Malformed application data, and execution of Malicious mobile code.

17. A method of preventing performance of processing operations that produce processing outcomes that violate a security policy in a computerized device, the method comprising:

operating a plurality of security interceptors that monitor operation of different respective processing activities of the computerized device to detect a sequence of related processing operations within the computerized device for those respective processing activities;

recording, in a security history, the sequence of related processing operations for each processing activities in the computerized device;

identifying an undesired processing operation and in response, comparing the security history to at least one formerly collected security history to identify a common sequence of related processing operations that occurred in each security history before occurrence of the undesired processing operation, and in response, marking that common sequence of related processing operations as being a disallowed sequence of related processing operations in the security policy; and

operating the plurality of security interceptors to subsequently detect attempted performance of the disallowed sequence of related processing operations, and in response, denying operation of the disallowed sequence of related processing operations by at least one of the processing activities within the computerized device to avoid violation of the security policy.

18. A computerized device comprising:

a memory;

a processor;

a communications interface coupled to a network;

an interconnection mechanism coupling the memory, the processor and the communications interface;

wherein the memory is encoded with a security agent, that when executed on the processor, causes the processor to perform the operations of;

operating a plurality of security interceptors that monitor operation of different respective processing activities of the computerized device to detect a sequence of related processing operations within the computerized device for those respective processing activities;

recording, in a security history, the sequence of related processing operations for each processing activities in the computerized device;

identifying an undesired processing operation and in response, causing comparison of the security history to at least one formerly collected security history to identify a common sequence of related processing operations that occurred in each security history before occurrence of the undesired processing operation, and in response, marking that common sequence of related processing operations as being a disallowed sequence of related processing operations in the security policy; and

operating the plurality of security interceptors to subsequently detect attempted performance of the disallowed sequence of related processing operations, and in response, denying operation of the disallowed sequence of related processing operations by at least one of the processing activities within the computerized device to avoid violation of the security policy.

19. A computer readable medium including computer program logic instruction encoded thereon, that when executed on a processor in a computerized device, prevent performance of processing operations that produce processing outcomes that violate a security policy in the computerized device, by causing the computerized device to perform the operations of:

operating a plurality of security interceptors that monitor operation of different respective processing activities of the computerized device to detect a sequence of related processing operations within the computerized device for those respective processing activities;

recording, in a security history, the sequence of related processing operations for each processing activities in the computerized device;

identifying an undesired processing operation and in response, comparing the security history to at least one formerly collected security history to identify a common sequence of related processing operations that occurred in each security history before occurrence of the undesired processing operation, and in response, marking that common sequence of related processing operations as being a disallowed sequence of related processing operations in the security policy; and

operating the plurality of security interceptors to subsequently detect attempted performance of the disallowed sequence of related processing operations, and in response, denying operation of the disallowed sequence of related processing operations by at least one of the processing activities within the computerized device to avoid violation of the security policy.