SERVER DRIFT MONITORING
First Claim
1. A method comprising:
- configuring a plurality of servers, each one of the plurality of servers including one or more executables forming a baseline;
instrumenting the plurality of servers to detect a drift including a change in the one or more executables from the baseline of the one of the plurality of servers;
monitoring the drift of the plurality of servers; and
initiating a remedial action when a drift of a first one of the plurality of servers deviates beyond a predetermined threshold from a drift of each other one of the plurality of servers.
4 Assignments
0 Petitions
Accused Products
Abstract
Threat detection is improved by monitoring variations in observable events and correlating these variations to malicious activity. The disclosed techniques can be usefully employed with any attribute or other metric that can be instrumented on an endpoint and tracked over time including observable events such as changes to files, data, software configurations, operating systems, and so forth. Correlations may be based on historical data for a particular machine, or a group of machines such as similarly configured endpoints. Similar inferences of malicious activity can be based on the nature of a variation, including specific patterns of variation known to be associated with malware and any other unexpected patterns that deviate from normal behavior. Embodiments described herein use variations in, e.g., server software updates or URL cache hits on an endpoint, but the techniques are more generally applicable to any endpoint attribute that varies in a manner correlated with malicious activity.
29 Citations
21 Claims
-
1. A method comprising:
-
configuring a plurality of servers, each one of the plurality of servers including one or more executables forming a baseline; instrumenting the plurality of servers to detect a drift including a change in the one or more executables from the baseline of the one of the plurality of servers; monitoring the drift of the plurality of servers; and initiating a remedial action when a drift of a first one of the plurality of servers deviates beyond a predetermined threshold from a drift of each other one of the plurality of servers. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A computer program product comprising non-transitory computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
-
configuring a plurality of servers, each one of the plurality of servers including one or more executables forming a baseline; instrumenting the plurality of servers to detect a drift including a change in the one or more executables from the baseline of the one of the plurality of servers; monitoring the drift of the plurality of servers; and initiating a remedial action when a drift of a first one of the plurality of servers deviates beyond a predetermined threshold from a drift of each other one of the plurality of servers. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18, 19)
-
-
20. A system comprising:
-
a plurality of servers each configured with one or more executables forming a baseline; a local drift monitor executing on each one of the plurality of servers, the local drift monitor configured to detect a drift including a change in the one or more executables; and a threat management facility coupled in a communicating relationship with each one of the plurality of servers, the threat management facility including a global drift monitor configured to monitor data from the local drift monitor on each one of the plurality of servers, and the threat management facility configured to initiate a remedial action when a drift of a first one of the plurality of servers deviates beyond a predetermined threshold from a drift of each other one of the plurality of servers.
-
-
21. A method comprising:
-
configuring a plurality of servers; instrumenting the plurality of servers to detect a behavior; monitoring the behavior on each of the plurality of servers; and initiating a remedial action when the behavior on a first one of the plurality of servers deviates beyond a predetermined threshold from the behavior on each other one of the plurality of servers.
-
Specification