Systems and Methods for Automated Memory and Thread Execution Anomaly Detection in a Computer Network

• US 20140068326A1
• Filed: 09/06/2012
• Published: 03/06/2014
• Est. Priority Date: 09/06/2012
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Triumfant Incorporated
• Inventors: Quinn, Mitchell N.
• Granted Patent: US 8,984,331 B2
• Time in Patent Office: Days
• US Class Current: 714/15
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0715 in a system implementing multitasking multitasking per se G06F9/46
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06

Abstract

Systems and methods are provided for detecting an anomaly in a computer that is part of a population of networked computers. Snapshots are received from a plurality of computers within the population of computers, where individual snapshots include a state of assets and runtime processes of a respective computer. An asset normalization model is generated from the snapshots and serves as a baseline model for detecting an anomaly in the state of assets and runtime processes of a respective computer. A snapshot from at least one of the computers is compared to the asset normalization model in order to determine whether an anomaly is present in a state of static assets and runtime processes of the at least one of the computers.

Claims

1. A method for detecting an anomaly in a computer that is part of a population of networked computers, the method comprising:

receiving snapshots from a plurality of computers within the population of computers, wherein individual snapshots include a state of assets and runtime processes of a respective computer;

generating an asset normalization model from the snapshots that serves as a baseline model for detecting an anomaly in the state of assets and runtime processes of a respective computer; and

comparing a snapshot from at least one of the computers to the asset normalization model to determine whether an anomaly is present in a state of static assets and runtime processes of the at least one of the computers.

2. The method of claim 1, further comprising deploying to the plurality of computers an agent that is configured for one or more of generating a snapshot, transmitting the snapshot, and detecting an anomaly using the asset normalization model.

3. The method of claim 1, wherein the snapshots comprise code segments that have been encoded using a transform function.

4. The method of claim 3, wherein the transform function includes a cryptographic hash.

5. The method of claim 1, wherein detecting an anomaly comprises detecting a behavioral anomaly.

6. The method of claim 5, wherein detecting a behavioral anomaly comprises detecting one or more of changes in code, changes in execution stack, and changes in thread execution.

7. The method of claim 6, wherein changes in code include changes in a code segment, code injection, and code removal.

8. The method of claim 6, wherein changes in execution stack include improper code addresses inserted into the call stack.

9. The method of claim 6, wherein changes in thread execution include improper thread creation, improper thread execution, and improper thread destruction.

10. The method of claim 5, deriving a statistical model for normal process execution in order to detect changes in runtime process behavior that constitute a behavioral anomaly.

11. The method of claim 1, further comprising:

searching the assets and runtime processes in order to find unique identifiers and related assets;

adding found unique identifiers to a list of previously found unique identifiers and related assets;

using the list to build a baseline of computer assets which contain these identifiers and related assets to scan during runtime operations in order to generate a snapshot; and

periodically updating the list of unique identifiers as assets and runtime processes are added and removed from a respective computer.

12. The method of claim 1, further comprising, when an anomaly is detected:

repairing the asset or runtime process associated with the anomaly by removing the asset, replacing the asset, or stopping the runtime process; and

repairing any faults in the execution stack associated with the anomaly.

13. A system for detecting an anomaly in a computer that is part of a population of networked computers, comprising:

a network interface configured to receive snapshots from a plurality of computers within the population of computers, wherein individual snapshots include a state of assets and runtime processes of a respective computer; and

a processor configured to;

generate an asset normalization model from the snapshots that serves as a baseline model for detecting an anomaly in the state of assets and runtime processes of a respective computer; and

compare a snapshot from at least one of the computers to the asset normalization model to determine whether an anomaly is present in a state of static assets and runtime processes of at least one of the computers.

14. The system of claim 13, wherein the processor is further configured to deploy to the plurality of computers an agent that is configured for one or more of generating a snapshot, transmitting the snapshot, and detecting an anomaly using the asset normalization model.

15. The system of claim 13, wherein the network interface is configured to receive snapshots that comprise code segments that have been encoded using a transform function.

16. The system of claim 13, wherein the processor is configured to detect a behavioral anomaly.

17. The system of claim 16, wherein the processor is configured to detect a behavioral anomaly comprising one or more of changes in code, changes in execution stack, and changes in thread execution.

18. The system of claim 17, wherein changes in code include changes in a code segment, code injection, and code removal.

19. The system of claim 17, wherein changes in execution stack include improper code addresses inserted into the call stack.

20. The system of claim 17, wherein changes in thread execution include improper thread creation, improper thread execution, and improper thread destruction.

21. The system of claim 16, wherein the processor is configured to derive a statistical model for normal process execution in order to detect changes in runtime process behavior that constitute a behavioral anomaly.

22. The system of claim 16, wherein the processor is configured to derive a statistical model for normal process execution in order to detect changes in runtime process behavior that constitute a behavioral anomaly.

23. The system of claim 13, wherein the processor is further configured to:

search the assets and runtime processes in order to find unique identifiers and related assets;

add found unique identifiers to a list of previously found unique identifiers and related assets;

use the list to build a baseline of computer assets which contain these identifiers and related assets to scan during runtime operations in order to generate a snapshot; and

periodically update the list of unique identifiers as assets and runtime processes are added and removed from a respective computer.

24. The system of claim 13, wherein when an anomaly is detected, the processor is further configured to:

repair the asset or runtime process associated with the anomaly by removing the asset, replacing the asset, or stopping the runtime process; and

repair any faults in the execution stack associated with the anomaly.

25. One or more computer readable storage media storing instructions for detecting an anomaly in a computer that is part of a population of networked computers, the instructions, when executed by a processor, cause the processor to:

receive snapshots from a plurality of computers within the population of computers, wherein individual snapshots include a state of assets and runtime processes of a respective computer;

generate an asset normalization model from the snapshots that serves as a baseline model for detecting an anomaly in the state of assets and runtime processes of a respective computer; and

compare a snapshot from at least one of the computers to the asset normalization model to determine whether an anomaly is present in a state of static assets and runtime processes of the at least one of the computers.

26. The computer readable storage media of claim 25, further comprising instructions that are operable to deploy to the plurality of computers an agent that is configured for one or more of generating a snapshot, transmitting the snapshot, and detecting an anomaly using the asset normalization model.

27. The computer readable storage media of claim 25, wherein the instructions that are operable to receive comprise instructions that are operable to receive the snapshots that comprise code segments that have been encoded using a cryptographic hash.

28. The computer readable storage media of claim 25, wherein the instructions that are operable to detect comprise instructions that are operable to detect a behavioral anomaly.

29. The computer readable storage media of claim 28, wherein the instructions that are operable to detect comprise instructions that are operable to detect a behavioral anomaly that one or more of changes in code, changes in execution stack, and changes in thread execution.

30. The computer readable storage media of claim 29, wherein changes in code include changes in a code segment, code injection, and code removal.

31. The computer readable storage media of claim 29, wherein changes in execution stack include improper code addresses inserted into the call stack.

32. The computer readable storage media of claim 29, wherein changes in thread execution include improper thread creation, improper thread execution, and improper thread destruction.

33. The computer readable storage media of claim 28, further comprising instructions that are operable to derive a statistical model for normal process execution in order to detect changes in runtime process behavior that constitute a behavioral anomaly.

34. The computer readable storage media of claim 25, further comprising instructions that are operable to:

search the assets and runtime processes in order to find unique identifiers and related assets;

add found unique identifiers to a list of previously found unique identifiers and related assets;

use the list to build a baseline of computer assets which contain these identifiers and related assets to scan during runtime operations in order to generate a snapshot; and

periodically update the list of unique identifiers as assets and runtime processes are added and removed from a respective computer.

35. The computer readable storage media of claim 25, wherein when an anomaly is detected, further comprising instructions that are operable to:

repair the asset or runtime process associated with the anomaly by removing the asset, replacing the asset, or stopping the runtime process; and

repair any faults in the execution stack associated with the anomaly.