Computer implemented techniques for detecting, investigating and remediating security violations to IT infrastructure
First Claim
1. A method, comprising:
- performing, by a computer system, an enforcement phase comprising;
collecting, by the computer system, system calls and call parameters invoked by monitored applications for each of a plurality of target computer systems, where the system calls and call parameters are received from operating system kernels on the plurality of target computer systems, where the operating system kernels have been instrumented to report system calls and call parameters invoked by the monitored applications, wherein the collecting in the enforcement phase collects from the target computer systems other security-sensitive activities selected from network connections, network bindings, process creations, and kernel module insertions;
correlating, by the computer system, sequences of systems calls and call parameters of the monitored applications among different target computer systems to determine violations in baseline patterns for the monitored applications that were learned during a learning phase performed prior to the enforcement phase, and therefore to deduce malicious activities, wherein the correlating in the enforcement phase correlates the other security-sensitive activities also to determine violations in baseline patterns for the monitored applications that were learned during the learning phase to deduce malicious activities; and
performing, by the computer system, one or more remedial actions in response to one or more activities being deduced as being malicious; and
wherein the learning phase that was performed prior to the enforcement phase determined the baseline patterns for the monitored applications for multiple observed computer systems, wherein the learning phase comprised;
collecting system calls and call parameters invoked by the monitored applications for each of the multiple observed computer systems; and
correlating sequences of systems calls and call parameters of the monitored applications among different multiple observed computer systems to determine the baseline patterns for the monitored applications.
3 Assignments
0 Petitions
Accused Products
Abstract
A method includes collecting system calls and call parameters invoked by monitored applications for target computer systems. The system calls and call parameters are received from operating system kernels on the plurality of target computer systems. Sequences of systems calls and call parameters of the monitored applications are correlated among different target computer systems to deduce malicious activities. Remedial action(s) are performed in response to malicious activities being deduced as being malicious by the correlating. Another method includes determining that network activity at a specific time is deemed to be suspicious. Using IP addresses involved in the suspicious network activity, computer system(s) are determined that are sources of the suspicious network activity. Based on the specific time and the determined computer system(s), application(s) are determined that are executing on the determined computer system(s) that are causing the suspicious network activity. Remedial action(s) are performed for the determined computer system(s).
24 Citations
20 Claims
-
1. A method, comprising:
-
performing, by a computer system, an enforcement phase comprising; collecting, by the computer system, system calls and call parameters invoked by monitored applications for each of a plurality of target computer systems, where the system calls and call parameters are received from operating system kernels on the plurality of target computer systems, where the operating system kernels have been instrumented to report system calls and call parameters invoked by the monitored applications, wherein the collecting in the enforcement phase collects from the target computer systems other security-sensitive activities selected from network connections, network bindings, process creations, and kernel module insertions; correlating, by the computer system, sequences of systems calls and call parameters of the monitored applications among different target computer systems to determine violations in baseline patterns for the monitored applications that were learned during a learning phase performed prior to the enforcement phase, and therefore to deduce malicious activities, wherein the correlating in the enforcement phase correlates the other security-sensitive activities also to determine violations in baseline patterns for the monitored applications that were learned during the learning phase to deduce malicious activities; and performing, by the computer system, one or more remedial actions in response to one or more activities being deduced as being malicious; and wherein the learning phase that was performed prior to the enforcement phase determined the baseline patterns for the monitored applications for multiple observed computer systems, wherein the learning phase comprised; collecting system calls and call parameters invoked by the monitored applications for each of the multiple observed computer systems; and correlating sequences of systems calls and call parameters of the monitored applications among different multiple observed computer systems to determine the baseline patterns for the monitored applications. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12)
-
-
13. An apparatus, comprising:
-
one or more processors; and one or more memories comprising computer readable code, wherein the one or more processors, in response to execution of the computer program code, cause the apparatus to perform at least the following; performing, by a computer system, an enforcement phase comprising; collecting system calls and call parameters invoked by monitored applications for each of a plurality of target computer systems, where the system calls and call parameters are received from operating system kernels on the plurality of target computer systems, where the operating system kernels have been instrumented to report system calls and call parameters invoked by the monitored applications, wherein the collecting in the enforcement phase collects from the target computer systems other security-sensitive activities selected from network connections, network bindings, process creations, and kernel module insertions; correlating sequences of systems calls and call parameters of the monitored applications among different target computer systems to determine violations in baseline patterns for the monitored applications that were learned during a learning phase performed prior to the enforcement phase, and therefore to deduce malicious activities, wherein the correlating in the enforcement phase correlates the other security-sensitive activities also to determine violations in baseline patterns for the monitored applications that were learned during the learning phase to deduce malicious activities; and performing one or more remedial actions in response to one or more activities being deduced as being malicious; and wherein the learning phase that was performed prior to the enforcement phase determined baseline patterns for the monitored applications for multiple observed computer systems, wherein the learning phase comprised; collecting system calls and call parameters invoked by the monitored applications for each of the multiple observed computer systems; and correlating sequences of systems calls and call parameters of the monitored applications among different multiple observed computer systems to determine the baseline patterns for the monitored applications. - View Dependent Claims (14, 15, 16, 17, 18, 19)
-
-
20. A computer program product, comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by an apparatus comprising one or more processors to cause the apparatus to perform at least the following:
-
performing, by a computer system, an enforcement phase comprising; collecting, by the computer system, system calls and call parameters invoked by monitored applications for each of a plurality of target computer systems, where the system calls and call parameters are received from operating system kernels on the plurality of target computer systems, where the operating system kernels have been instrumented to report system calls and call parameters invoked by the monitored applications, wherein the collecting in the enforcement phase collects from the target computer systems other security-sensitive activities selected from network connections, network bindings, process creations, and kernel module insertions; correlating, by the computer system, sequences of systems calls and call parameters of the monitored applications among different target computer systems to determine violations in baseline patterns for the monitored applications that were learned during a learning phase performed prior to the enforcement phase, and therefore to deduce malicious activities, wherein the correlating in the enforcement phase correlates the other security-sensitive activities also to determine violations in baseline patterns for the monitored applications that were learned during the learning phase to deduce malicious activities; and
11performing, by the computer system, one or more remedial actions in response to one or more activities being deduced as being malicious; and wherein the learning phase that was performed prior to the enforcement phase determined the baseline patterns for the monitored applications for multiple observed computer systems, wherein the learning phase comprised; collecting system calls and call parameters invoked by the monitored applications for each of the multiple observed computer systems; and correlating sequences of systems calls and call parameters of the monitored applications among different multiple observed computer systems to determine the baseline patterns for the monitored applications.
-
Specification