Computer Implemented Techniques for Detecting, Investigating and Remediating Security Violations to IT Infrastructure

• US 20150264077A1
• Filed: 09/30/2014
• Published: 09/17/2015
• Est. Priority Date: 03/13/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chen, Yangyi, Hu, Xin, Rao, Josyula, Schales, Douglas Lee, Berger, Stefan, Pendarakis, Dimitrious, Sailer, Reiner, Stoecklin, Marc
• Granted Patent: US 9,832,217 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method includes collecting system calls and call parameters invoked by monitored applications for target computer systems. The system calls and call parameters are received from operating system kernels on the plurality of target computer systems. Sequences of systems calls and call parameters of the monitored applications are correlated among different target computer systems to deduce malicious activities. Remedial action(s) are performed in response to malicious activities being deduced as being malicious by the correlating. Another method includes determining that network activity at a specific time is deemed to be suspicious. Using IP addresses involved in the suspicious network activity, computer system(s) are determined that are sources of the suspicious network activity. Based on the specific time and the determined computer system(s), application(s) are determined that are executing on the determined computer system(s) that are causing the suspicious network activity. Remedial action(s) are performed for the determined computer system(s).

Claims

1. A method, comprising:

collecting, by a computer system, system calls and call parameters invoked by monitored applications for each of a plurality of target computer systems, where the system calls and call parameters are received from operating system kernels on the plurality of target computer systems, where the operating system kernels have been instrumented to report system calls and call parameters invoked by the monitored applications;

correlating, by the computer system, sequences of systems calls and call parameters of the monitored applications among different target computer systems to deduce malicious activities; and

performing, by the computer system, one or more remedial actions in response to one or more malicious activities being deduced as being malicious by the correlating.

2. The method of claim 1, wherein at least one of the plurality of target computer systems comprises a user level monitoring application performing at least one of processing system calls locally or forwarding system calls to another set of local or remote monitoring applications.

3. The method of claim 1, wherein the operating system kernels are run on the plurality of target computer systems and wherein:

the target computer systems further implement a transitive trust chain architecture;

the operating system kernels use the transitive trust chain architecture to monitor which executables, scripts, or libraries were run by users of a corresponding target computer system; and

the operating system kernels report information about said executables, scripts, or libraries to the computer system for collecting and processing.

4. The method of claim 1, further comprising recording reported system call invocations in a database, wherein the correlating comprises correlating received reported system call invocations with recorded reported system call invocations from the database to deduce malicious activities.

5. The method of claim 1, where executables, scripts, or libraries are acquired by crawling public software package repositories, the method comprising:

receiving a list of repositories to crawl;

logging into the repositories and walking a list of directories recursively;

comparing names and version information of software installation packages found in said directories against known packages and package versions in a database;

downloading those software installation packages that are not known;

extracting the files of those software installation packages on a system;

calculating checksums on said files; and

recording at least the checksums and file metadata of said files into a database.

6. The method of claim 5, where each of the checksums is a hash.

7. The method of claim 1, wherein:

collecting comprises receiving one or more values for hashes from one or more of the target computer systems;

correlating further comprises;

comparing the received one or more values of the hashes with values of hashes in one or more databases; and

deducing a malicious activity has occurred in response to the received one or more values of the hashes not corresponding to values of hashes in the one or more databases; and

performing one or more remedial actions comprises outputting an alert indicating the received one or more values of the hashes do not correspond to values of hashes in the one or more databases.

8. The method of claim 1, wherein:

collecting comprises receiving a value for a key or its identifier from one or more of the target computer systems, the value of the key or its identifier corresponding to a particular monitored application;

correlating further comprises;

comparing the received value for the key or its identifier with values of keys or identifiers, respectively, in one or more databases; and

deducing a malicious activity has occurred in response to the received value of the key or its identifier not corresponding to values of keys or identifier in the one or more databases or the received value of the key or identifier not matching with a key or identifier in the one or more databases for the particular monitored application; and

performing one or more remedial actions comprises outputting an alert indicating the received key or identifier does not correspond to a key or identifier for the particular monitored application in the one or more databases.

9. The method of claim 1, wherein at least one of the target computer systems comprises a virtual machine and wherein performing one or more remedial actions further comprises one of causing the virtual machine to be placed in a quarantine network, causing the virtual machine to be paused, or causing the virtual machine to be shutdown.

10. The method of claim 1, wherein at least one of the target computer systems comprises a particular computer system and wherein performing one or more remedial actions further comprises causing the particular computer system to be isolated at least by causing blocking of network traffic to and from the particular computer system.

11. An apparatus, comprising:

one or more processors; and

one or more memories comprising computer readable code,

wherein the one or more processors, in response to execution of the computer program code, cause the apparatus to perform at least the following;

collecting system calls and call parameters invoked by monitored applications for each of a plurality of target computer systems, where the system calls and call parameters are received from operating system kernels on the plurality of target computer systems, where the operating system kernels have been instrumented to report system calls and call parameters invoked by the monitored applications;

correlating sequences of systems calls and call parameters of the monitored applications among different target computer systems to deduce malicious activities; and

performing one or more remedial actions in response to one or more malicious activities being deduced as being malicious by the correlating.

12. The apparatus of claim 11, wherein at least one of the plurality of target computer systems comprises a user level monitoring application performing at least one of processing system calls locally or forwarding system calls to another set of local or remote monitoring applications.

13. The apparatus of claim 11, wherein the operating system kernels are run on the plurality of target computer systems and wherein:

the target computer systems further implement a transitive trust chain architecture;

the operating system kernels use the transitive trust chain architecture to monitor which executables, scripts, or libraries were run by users of a corresponding target computer system; and

the operating system kernels report information about said executables, scripts, or libraries to the computer system for collecting and processing.

14. The apparatus of claim 11, wherein the one or more processors, in response to execution of the computer program code, further cause the apparatus to perform at least the following:

recording reported system call invocations in a database, wherein the correlating comprises correlating received reported system call invocations with recorded reported system call invocations from the database to deduce malicious activities.

15. The apparatus of claim 11, where executables, scripts, or libraries are acquired by crawling public software package repositories, wherein the one or more processors, in response to execution of the computer program code, further cause the apparatus to perform at least the following:

receiving a list of repositories to crawl;

logging into the repositories and walking a list of directories recursively;

comparing names and version information of packages found in said directories against known packages and package versions in a database;

downloading those packages that are not known;

extracting the files of those software packages on a system;

calculating checksums on said files; and

recording at least the checksums and file metadata of said files into a database.

16. The apparatus of claim 11, wherein:

collecting comprises receiving one or more values for hashes from one or more of the target computer systems;

correlating further comprises;

comparing the received one or more values of the hashes with values of hashes in one or more databases; and

deducing a malicious activity has occurred in response to the received one or more values of the hashes not corresponding to values of hashes in the one or more databases; and

performing one or more remedial actions comprises outputting an alert indicating the received one or more values of the hashes do not correspond to values of hashes in the one or more databases.

17. The apparatus of claim 11, wherein:

collecting comprises receiving a value for a key or its identifier from one or more of the target computer systems, the value of the key or its identifier corresponding to a particular monitored application;

correlating further comprises;

comparing the received value for the key or its identifier with values of keys or identifiers, respectively, in one or more databases; and

deducing a malicious activity has occurred in response to the received value of the key or its identifier not corresponding to values of keys or identifier in the one or more databases or the received value of the key or identifier not matching with a key or identifier in the one or more databases for the particular monitored application; and

performing one or more remedial actions comprises outputting an alert indicating the received key or identifier does not correspond to a key or identifier for the particular monitored application in the one or more databases.

18. The apparatus of claim 11, wherein at least one of the target computer systems comprises a virtual machine and wherein performing one or more remedial actions further comprises one of causing the virtual machine to be placed in a quarantine network, causing the virtual machine to be paused, or causing the virtual machine to be shutdown.

19. The apparatus of claim 11, wherein at least one of the target computer systems comprises a particular computer system and wherein performing one or more remedial actions further comprises causing the particular computer system to be isolated at least by causing blocking of network traffic to and from the particular computer system.

20. A method, comprising:

determining that network activity at a specific time is deemed to be suspicious;

determining, using Internet protocol addresses involved in the suspicious network activity, one or more computer systems that are sources of the suspicious network activity;

determining, based on the specific time and the determined one or more computer systems, one or more applications executing on the one or more determined computer systems that are causing the suspicious network activity; and

causing one or more remedial actions to be performed for the determined one or more computer systems.

21. The method of claim 20, wherein at least one of the determined one or more computer systems comprises a virtual machine and wherein causing the one or more remedial actions to be performed further comprises one of causing the virtual machine to be placed in a quarantine network, causing the virtual machine to be paused, or causing the virtual machine to be shutdown.

22. The method of claim 20, wherein at least one of the determined one or more computer systems comprises a particular computer system and wherein performing one or more remedial actions further comprises causing the particular computer system to be isolated at least by causing blocking of network traffic to and from the particular computer system.

23. The method of claim 20, wherein determining that network activity at a specific time is deemed to be suspicious is based at least on network activity as observed on switches.

24. The method of claim 20, wherein:

the method further comprises displaying on a display of a particular computer system network activity as observed on switches for a plurality of computer systems;

the determining that network activity at a specific time is deemed to be suspicious is performed by an administrator based at least on the displayed network activity;

the method further comprises displaying on the display of the particular computer system Internet protocol addresses determined to be involved in the suspicious network activity;

the determining one or more computer systems that are sources of the suspicious network activity is performed by the administrator or automatically by an application based on the determined Internet protocol addresses involved in the suspicious network activity;

the method further comprises displaying on the display of the particular computer system a plurality of applications executing on the one or more computer systems;

the determining one or more applications executing on the one or more computer systems that are causing the network activity is performed by an administrator using the displayed plurality of applications executing on the one or more computer systems; and

causing one or more remedial actions to be performed for the one or more computer systems is performed by the particular computer system, responsive to input from the administrator.

25. The method of claim 20, wherein a specific computer system performs the determining that network activity at a specific time is deemed to be suspicious, the determining one or more computer systems that are sources of the suspicious network activity, the determining the one or more applications executing on the one or more computer systems that are causing the network activity, and the causing one or more remedial actions to be performed for the one or more computer systems.