Path-based program lineage inference analysis

Patent metadata

Field	Value
Publication number	US-10853487-B2
Application number	US-201816039993-A
Country	US
Kind code	B2
Filing date	Jul 19, 2018
Priority date	Aug 11, 2017
Publication date	Dec 1, 2020
Grant date	Dec 1, 2020

Abstract

Systems and methods are disclosed for securing an enterprise environment by detecting suspicious software. A global program lineage graph is constructed. Construction of the global program lineage graph includes creating a node for each version of a program having been installed on a set of user machines. Additionally, at least two nodes are linked with a directional edge. For each version of the program, a prevalence number of the set of user machines on which each version of the program had been installed is determined; and the prevalence number is recorded to the metadata associated with the respective node. Anomalous behavior is identified based on structures formed by the at least two nodes and associated directional edge in the global program lineage graph. An alarm is displayed on a graphical user interface for each suspicious software based on the identified anomalous behavior.

First claim

What is claimed is:

1. A computer-implemented method for securing an enterprise environment by detecting suspicious software, comprising:
constructing a global program lineage graph comprising:
creating a node for each version of a program installed on a set of user machines, the node including metadata including an event time associated with the respective version of the program, each node being identified by a unique identifier, wherein the same version of the program installed on different user machines has the same node on the global lineage graph, the version of the program determined by an identifier unique to the version and program combination,
linking at least two nodes with a directional edge, the directional edge representing a progression from a first version of the program to a next version of the program based on the event time of each version of the program, and
determining, for each version of the program, a prevalence number of the set of user machines on which each version of the program had been installed and recording the prevalence number to the metadata associated with the respective node;

identifying anomalous behavior, indicative of a suspicious software, based on structures formed by the at least two nodes and associated directional edge in the global program lineage graph; and
displaying an alarm on a graphical user interface for the suspicious software indicated by the identified anomalous behavior.

2. The computer-implemented method as recited in claim 1 , wherein identifying anomalous behavior further comprises verifying the unique identifier of each node, the unique identifier being a program signature.

3. The computer-implemented method as recited in claim 1 , further comprising generating each unique identifier by applying a hash function to the respective version of the program.

4. The computer-implemented method as recited in claim 1 , wherein determining the prevalence number includes incrementing a global prevalence node counter for each appearance of the version of the program on the set of user machines.

5. The computer-implemented method as recited in claim 1 , wherein determining the prevalence number includes incrementing a global prevalence edge counter for each appearance of respective directional edges on the set of user machines.

6. The computer-implemented method as recited in claim 1 , wherein determining the prevalence number includes incrementing a machine prevalence node counter for each user machine of the set of user machines on which the respective version of the program appears.

7. The computer-implemented method as recited in claim 1 , wherein determining the prevalence number includes incrementing a machine prevalence edge counter for each user machine of the set of user machines on which respective directional edges appear.

8. A supervisory machine for securing an enterprise environment by detecting suspicious software, the supervisory machine being in electrical communication with one or more user machines, the supervisory machine comprising:
a storage device configured to store program lineage data received from the one or more user machines, and a global program lineage graph;
a processor operatively coupled to the storage device and configured to detecting suspicious software by executing program code, stored on the storage device, to:
construct the global program lineage graph, the global program lineage graph including: a node for each version of a program installed on a set of user machines, the node including metadata including an event time associated with the respective version of the program, wherein the same version of the program installed on different user machines has the same node on the global lineage graph, the version of the program determined by an identifier unique to the version and program combination, each node being identified by a unique identifier, and a directional edge linking at least two nodes, the directional edge representing a progression from a first version of the program to a next version of the program based on the event time of each version of the program,
determine, for each version of the program, a prevalence number of the set of user machines on which each version of the program had been installed and record the prevalence number to the metadata associated with the respective node, and
identify anomalous behavior, indicative of a suspicious software, based on structures formed by the at least two nodes and associated directional edge in the global program lineage graph; and

a display screen having a graphical user interface implemented by the processor and displayed on the display screen, the graphical user interface configured to present an alarm for the suspicious software indicated by the identified anomalous behavior.

9. The supervisory machine as recited in claim 8 , wherein the processor verifies the unique identifier of each node, the unique identifier being a program signature.

10. The supervisory machine as recited in claim 8 , wherein the processor generates the unique identifier by applying a hash function to the respective version of the program.

11. The supervisory machine as recited in claim 8 , wherein the processor determines the prevalence number by incrementing a global prevalence node counter for each appearance of the version of the program on the set of user machines.

12. The supervisory machine as recited in claim 8 , wherein the processor determines the prevalence number by incrementing a global prevalence edge counter for each appearance of respective directional edges on the set of user machines.

13. The supervisory machine as recited in claim 8 , wherein the processor determines the prevalence number by incrementing a machine prevalence node counter for each user machine of the set of user machines on which the respective version of the program appears.

14. The supervisory machine as recited in claim 8 , wherein the processor determines the prevalence number by incrementing a machine prevalence edge counter for each user machine of the set of user machines on which respective directional edges appear.

15. A computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method for securing an enterprise environment by detecting suspicious software, comprising:
constructing a global program lineage graph comprising:
creating a node for each version of a program installed on a set of user machines, the node including metadata including an event time associated with the respective version of the program, each node being identified by a unique identifier, wherein the same version of the program installed on different user machines has the same node on the global lineage graph, the version of the program determined by an identifier unique to the version and program combination,
linking at least two nodes with a directional edge, the directional edge representing a progression from a first version of the program to a next version of the program based on the event time of each version of the program, and
determining, for each version of the program, a prevalence number of the set of user machines on which each version of the program had been installed and recording the prevalence number to the metadata associated with the respective node;

identifying anomalous behavior, indicative of a suspicious software, based on structures formed by the at least two nodes and associated directional edge in the global program lineage graph; and
displaying

Assignees

• Nec Lab America Inc
• Nec Corp

Inventors

• Rhee Junghwan
• Wu Zhenyu
• Korts-Parn Lauri
• Jee Kangkook
• Li Zhichun
• Setayeshfar Omid

Classifications

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F16/219

  Managing data history or versioning (querying versioned data G06F16/2474; querying temporal data G06F16/2477) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title