COMPUTER SYSTEM PROVIDING ANOMALY DETECTION WITHIN A VIRTUAL COMPUTING SESSIONS AND RELATED METHODS

• US 20180337936A1
• Filed: 05/16/2017
• Published: 11/22/2018
• Est. Priority Date: 05/16/2017
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Mehrotra, Mudit, Sandhu, Vikramjeet Singh, Kulkarni, Abhinav Muralidhar
• Granted Patent: US 11,394,731 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 2009/45579 I/O management, e.g. providing access to device drivers or storage
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/452 Remote windowing, e.g. X-Window System, desktop virtualisation protocols for virtual reality H04L67/131
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 20/10 using kernel methods, e.g. support vector machines [SVM]
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

A method may include running virtual sessions on a virtualization server for a plurality of client devices associated with respective users, with the virtual sessions being responsive to traffic from the client devices. The method may further include generating baseline traffic patterns for the users based upon the traffic from respective client devices during the virtual sessions, monitoring traffic during a new virtual session for a given client device and detecting an anomaly therein relative to at least one of the baseline traffic patterns, and generating an anomaly alert based upon detecting the anomaly.

Claims

1. A method comprising:

running virtual sessions on a virtualization server for a plurality of client devices associated with respective users, the virtual sessions being responsive to traffic from the client devices;

generating baseline traffic patterns for the users based upon the traffic from respective client devices during the virtual sessions;

monitoring traffic during a new virtual session for a given client device and detecting an anomaly therein relative to at least one of the baseline traffic patterns; and

generating an anomaly alert based upon detecting the anomaly.

2. The method of claim 1 wherein the client devices have keyboards associated therewith;

and wherein generating the baseline traffic patterns comprises generating the baseline traffic patterns based upon traffic from the keyboards to the client devices during the virtual sessions.

3. The method of claim 2 wherein generating the baseline traffic patterns further comprises generating the baseline traffic patterns based upon a typing speed associated with the traffic from the keyboards during the virtual sessions.

4. The method of claim 1 wherein generating the baseline traffic patterns comprises generating heat maps based upon the traffic from the client devices during the virtual sessions.

5. The method of claim 1 wherein the client devices have input/output (I/O) ports associated therewith;

and wherein generating the baseline traffic patterns comprises generating the baseline traffic patterns based upon traffic associated with the I/O ports.

6. The method of claim 1 wherein the at least one baseline traffic pattern comprises a baseline traffic pattern associated with the user of the given client device.

7. The method of claim 1 wherein the at least one baseline traffic pattern comprises a plurality of baseline traffic patterns associated with different users.

8. The method of claim 1 wherein generating the baseline traffic patterns comprises generating the baseline traffic patterns based upon machine learning.

9. The method of claim 1 wherein detecting comprises detecting the anomaly based upon a Gaussian distribution.

10. The method of claim 1 wherein the virtual sessions comprise at least one of virtual desktop sessions and virtual application sessions.

11. A virtualization server comprising:

a memory and a processor cooperating therewith to

run virtual sessions on a virtualization server for a plurality of client devices associated with respective users, the virtual sessions being responsive to traffic from the client devices;

generate baseline traffic patterns for the users based upon the traffic from respective client devices during the virtual sessions;

monitor traffic during a new virtual session for a given client device and detect an anomaly therein relative to at least one of the baseline traffic patterns; and

generate an anomaly alert based upon detecting the anomaly.

12. The virtualization server of claim 11 wherein the client devices have keyboards associated therewith;

and wherein the processor generates the baseline traffic patterns based upon traffic from the keyboards to the client devices during the virtual sessions.

13. The virtualization server of claim 12 wherein the processor generates the baseline traffic patterns based upon a typing speed associated with the traffic from the keyboards during the virtual sessions.

14. The virtualization server of claim 11 wherein the baseline traffic patterns comprise heat maps.

15. The virtualization server of claim 11 wherein the client devices have input/output (I/O) ports associated therewith;

and wherein the processor generates the baseline traffic patterns based upon traffic associated with the I/O ports.

16. A non-transitory computer-readable medium having computer-executable instructions for causing a processor of a virtualization server to perform steps comprising:

running virtual sessions on the virtualization server for a plurality of client devices associated with respective users, the virtual sessions being responsive to traffic from the client devices;

generating baseline traffic patterns for the users over a period of time based upon the traffic from respective client devices during the virtual sessions;

monitoring traffic during a new virtual session for a given client device and detecting an anomaly therein relative to at least one of the baseline traffic patterns; and

generating an anomaly alert based upon detecting the anomaly.

17. The non-transitory computer-readable medium of claim 16 wherein the client devices have keyboards associated therewith;

and wherein generating the baseline traffic patterns comprises generating the baseline traffic patterns based upon traffic from the keyboards to the client devices during the virtual sessions.

18. The non-transitory computer-readable medium of claim 17 wherein generating the baseline traffic patterns further comprises generating the baseline traffic patterns based upon a typing speed associated with the traffic from the keyboards during the virtual sessions.

19. The non-transitory computer-readable medium of claim 16 wherein generating the baseline traffic patterns comprises generating heat maps based upon the traffic from the client devices during the virtual sessions.

20. The non-transitory computer-readable medium of claim 16 wherein the client devices have input/output (I/O) ports associated therewith;

and wherein generating the baseline traffic patterns comprises generating the baseline traffic patterns based upon traffic associated with the I/O ports.