Entropy based security detection system

Patent metadata

Field	Value
Publication number	US-10860712-B2
Application number	US-201816032349-A
Country	US
Kind code	B2
Filing date	Jul 11, 2018
Priority date	Jul 11, 2018
Publication date	Dec 8, 2020
Grant date	Dec 8, 2020

Abstract

A virtual computing instance (VCI) is protected against security threats by a security manager, monitoring a behavior of a VCI over an observation period. The method further includes, storing by the security manager a digital profile in a first database, wherein the digital profile comprises information indicative of the behavior. The method further includes, accessing by a detection system, the digital profile from the first database, and accessing by the detection system, an intended state associated with VCI, wherein the intended state comprises information indicative of a behavior from a second VCI. The method further includes, comparing at least part of the digital profile to the at least part of the intended state. The method further includes, determining by the detection system, that the VCI contains a security threat when information indicative of a behavior in the digital profile is an outlier.

First claim

What is claimed is:

1. A method of detecting a security threat in a computing system comprising:
monitoring by a security manager of the computing system, at least one behavior of at least one virtual computing instance (VCI) over an observation period;
storing by the security manager a digital profile in a first database, wherein the digital profile comprises information indicative of the at least one behavior;
accessing by a detection system, the digital profile from the first database;
accessing by the detection system, an intended state associated with the VCI from a second database, wherein the intended state comprises information indicative of one or more behaviors of a second VCI;
comparing at least a part of the digital profile to at least a part of the intended state; and
determining by the detection system, that the VCI contains a security threat when a behavior indicated in the digital profile is an outlier as compared to the intended state, wherein the behavior indicated in the digital profile is determined to be an outlier when the behavior, if removed from a data set comprising behavior indicated in the intended state and behavior indicated in the digital profile, would reduce an entropy of the data set by a threshold.

2. The method of claim 1 , wherein another behavior indicated in the digital profile is an outlier when the other behavior is not indicated in the intended state.

3. The method of claim 1 , wherein another behavior indicated in the digital profile is an outlier based in part on an outlier factor, and wherein the outlier factor is based in part on an outlier factor computation of the data set.

4. The method of claim 3 , wherein the outlier factor computation comprises:
determining a first outlier factor for a first behavior indicated in the digital profile using an outlier factor computation; and
determining a second outlier factor for a second behavior indicated in the digital profile using an outlier factor update computation.

5. The method of claim 1 , wherein determining by the detection system that the VCI contains a security threat when a behavior indicated in the digital profile is an outlier further comprises one or more of:
generating by the security manager a security alert or causing a remediation broker to take a remedial action.

6. The method of claim 1 , wherein the information indicative of the one or more behaviors of the second VCI is based in part on an operating system process.

7. The method of claim 1 , wherein comparing at least a part of the digital profile to at least a part of the intended state is based at least in part on comparing features that are present in the intended state and ignoring features that are only present in the digital profile.

8. The method of 1 , wherein an intended state is generated by:
executing at least one candidate process on the second VCI;
monitoring the one or more behaviors of the second VCI executing the at least one candidate process for an observation period;
extracting at least one feature from the one or more behaviors; and
storing information indicative of the one or more behaviors comprising the at least one feature as the intended state in the second database.

9. A non-transitory computer readable medium comprising instructions to be executed in a processor of a computer system, the instructions when executed in the processor cause the computer system to carry out a method of detecting a security threat in a computing system comprising:
monitoring by a security manager of the computing system, at least one behavior of at least one virtual computing instance (VCI) over an observation period;
storing by the security manager a digital profile in a first database, wherein the digital profile comprises information indicative of the at least one behavior;
accessing by a detection system, the digital profile from the first database;
accessing by the detection system, an intended state associated with the VCI from a second database, wherein the intended state comprises information indicative of one or more behaviors of a second VCI;
comparing at least a part of the digital profile to at least a part of the intended state; and
determining by the detection system, that the VCI contains a security threat when a behavior indicated in the digital profile is an outlier as compared to the intended state, wherein the behavior indicated in the digital profile is determined to be an outlier when the behavior, if removed from a data set comprising behavior indicated in the intended state and behavior indicated in the digital profile, would reduce an entropy of the data set by a threshold.

10. The non-transitory computer readable medium of claim 9 , wherein another behavior indicated in the digital profile is an outlier when the other behavior is not indicated in the intended state.

11. The non-transitory computer readable medium of claim 9 , wherein another behavior indicated in the digital profile is an outlier based in part on an outlier factor, and wherein the outlier factor is based in part on an outlier factor computation of the data set.

12. The non-transitory computer readable medium of claim 11 , wherein the outlier factor computation comprises:
determining a first outlier factor for a first behavior indicated in digital profile using an outlier factor computation; and
determining a second outlier factor for a second behavior indicated in the digital profile using an outlier factor update computation.

13. The non-transitory computer readable medium of claim 9 , wherein determining by the detection system that the VCI contains a security threat when a behavior indicated in the digital profile is an outlier further comprises one or more of:
generating by the security manager a security alert or causing a remediation broker to take a remedial action.

14. A computer system comprising:
a first host that includes:
a processor; and
a non-transitory computer readable medium having stored thereon program code that, when executed, causes the processor on the first host to:

monitor at least one behavior of at least one virtual computing instance (VCI) over an observation period;
store a digital profile in a first database, wherein the digital profile comprises information indicative of the at least one behavior; and
a second host that includes:
a processor; and
a non-transitory computer readable medium having stored thereon program code that, when executed, causes the processor on the second host to:

access the digital profile from the first database;
access an intended state associated with the VCI from a second database, wherein the intended state comprises information indicative of one or more behaviors of a second VCI;
compare at least a part of the digital profile to at least a part of the intended state; and
determine that the VCI contains a security threat when a behavior indicated in the digital profile is an outlier as compared to the intended state, wherein the behavior indicated in the digital profile is determined to be an outlier when the behavior, if removed from a data set comprising behavior indicated in the intended state and behavior indicated in the digital profile, would reduce an entropy of the data set by a threshold.

15. The computing system of claim 14 , wherein another behavior indicated in the digital profile is an outlier when the other behavior is not indicated in the intended state.

16. The computing system of claim 14 , wherein another behavior indicated in the digital profile is an outlier based in part on an outlier factor, and wherein the outlier fac

Assignees

• Vmware Inc

Inventors

• Mo Zhen
• Wang Dexiang
• Zan Bin
• Ganti Vijay
• Chopra Amit

Classifications

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title