Monitoring for anomalies in a computing environment

• US 9,141,791 B2
• Filed: 11/19/2012
• Issued: 09/22/2015
• Est. Priority Date: 11/19/2012
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Rajagopalan, Siva Raj, Shiva, SM Prakash
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US13/680,731
• Publication Number:
  US 20140143868A1
• Time in Patent Office: 1,037 Days
• Field of Search: 726/23
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic

Abstract

A method of monitoring for anomalies in a computing environment comprises, with a processor building an anomaly detection system based on topology guided statistical analysis, and creating a number of correlation rules based on a number of detected anomalies and information provided by a security alerts database.

Claims

1. A method of monitoring for anomalies in a computing environment comprising:

by a processor, building an anomaly detection system based on topology guided statistical analysis, comprising;

by the processor executing a monitoring application, determining transaction and performance data of a number of configuration items in a topology of a web application executed within the computing environment correlated with data associated with the topology of the web application; and

by the processor, identifying a number of metrics for each of the configuration items; and

by the processor, storing, in a performance management database (PMDB), the transaction and performance data of the configuration items, correlated data associated with the topology of the web application, and the metrics of the configuration items;

by the processor, determining if a first metric of the number of metrics deviates from a metric baseline;

by the processor, responsive to a determination that the first metric deviates from the metric baseline, flagging the first metric as a potential malicious anomaly;

by the processor, creating a number of correlation rules to detect a number of intrusions, the correlation rules based on the transaction and performance data of the configuration items, correlated data associated with the topology of the web application, the metrics of the configuration items, the flagged anomaly, and information provided by a security alerts database, the security alert database comprising stored data regarding security alerts reported from a security management software product;

by the processor, applying the correlation rules to detect the intrusions in the computing environment;

by the processor, determining if a suspicious session is reported within the security alerts stored in the security alert database;

by the processor, responsive to a determination that the suspicious session is reported within the security alerts stored in the security alert database, classifying the flagged anomaly as a first intrusion in the computing environment and classifying the suspicious session as the first intrusion; and

by the processor, responsive to a determination that the suspicious session is not reported within the security alerts stored in the security alert database, classifying the flagged anomaly as an intrusion in the computing environment detected through statistical analysis.

2. The method of claim 1, further comprising, by the processor, determining the metric baseline for the metrics.

3. The method of claim 2, in which determining if any of the metrics deviate from a respective baseline comprises determining, by the processor, a relationship baseline for a number of relationships between the metrics of the configuration items.

4. The method of claim 1, in which the topology guided statistical analysis comprises multivariate correlations between transactions, applications, systems, and network usage metrics.

5. The method of claim 1, further comprising, by the processor, creating a report of the first intrusion.

6. The method of claim 1, in which building the anomaly detection system is based on at least one relationship between metrics.

7. The method of claim 1, in which each of the metrics are defined as a function of other metrics, comprising, by the processor:

defining the baseline by a number of relationships between the metrics of the configuration items, in which the relationships between the metrics of the configuration items are defined mathematically, and wherein the first metric is defined as a function of a number of other metrics within the topology of the web application.

8. A hybrid intrusion detection system (IDS), comprising:

a configuration management database to store data regarding a number of configuration items within a computing environment;

a performance management database to store data related to a number of resource usage metrics;

a security alert database to store data associated with a number of security alerts reported from a security management software product; and

a computing device comprising;

a processor that implements computer-readable instructions stored in a data storage device to perform functionality that;

detects a number of anomalies using topology guided statistical analysis;

determines the resource usage metrics correlated with data associated with a topology of a web application, the resource usage metrics comprising transaction and performance data of the configuration items in the topology of the web application executed within the computing environment;

determines if a first resource usage metric of the number of resource usage metrics deviates from a metric baseline;

responsive to a determination that the first resource usage metric deviates from the metric baseline, flags the first resource usage metric as a potential malicious anomaly;

creates a number of correlation rules based on the resource usage metrics, correlated data associated with the topology of the web application, the data regarding the configuration items, the flagged anomaly, and the data associated with the number of security alerts provided by the security alerts database;

applies the correlation rules to detect intrusions within the computing device;

determines if a suspicious session is reported within the security alerts stored in the security alert database;

responsive to a determination that the suspicious session is reported within the security alerts stored in the security alert database, classifies the flagged anomaly as a first intrusion in the computing environment and classifies the suspicious session as the first intrusion; and

responsive to a determination that the suspicious session is not reported within the security alerts stored in the security alert database, classifies the flagged anomaly as an intrusion detected through statistical analysis.

9. The hybrid IDS of claim 8, further comprising a correlation rules database to store the correlation rules.

10. A computer program product for monitoring for anomalies in a computing environment, the computer program product comprising:

a non-transitory computer readable storage medium comprising computer usable program code embodied therewith, the computer usable program code that, when executed by a processor, causes a computing device in the computing environment to;

identify a number of metrics for each of a number of configuration items in a topology of a web application executed within the computing environment;

determine a metric baseline for the metrics;

determine a relationship baseline for a number of relationships between the metrics of the configuration items;

determine if a first metric of the number of metrics deviates from the metric baseline;

responsive to a determination that the first metric deviates from the metric baseline,

flags the first metric as a potential malicious anomaly;

create a number of correlation rules based on transaction and performance data correlated with the topology data of the web, the metrics of the configuration items, the flagged anomaly, and security alert information provided by a security alerts database, the security alert database comprising stored data regarding security alerts reported from a security management software product;

apply the correlation rules to detect intrusions within the computing environment;

determine if a suspicious session is reported within the security alerts stored in a security alert database;

responsive to a determination that the suspicious session is reported within the security alerts stored in the security alert database, classify the flagged anomaly as a first intrusion in the computing environment and classify the suspicious session as the first intrusion; and

responsive to a determination that the suspicious session is not reported within the security alerts stored in the security alert database, classify the flagged anomaly as an intrusion in the computing environment detected through statistical analysis.