Inter-application dependency analysis for improving computer system threat detection

Patent metadata

Field	Value
Publication number	US-11030308-B2
Application number	US-201816006164-A
Country	US
Kind code	B2
Filing date	Jun 12, 2018
Priority date	Aug 9, 2017
Publication date	Jun 8, 2021
Grant date	Jun 8, 2021

Abstract

A method and system are provided for improving threat detection in a computer system by performing an inter-application dependency analysis on events of the computer system. The method includes receiving, by a processor operatively coupled to a memory, a Tracking Description Language (TDL) query including general constraints, a tracking declaration and an output specification, parsing, by the processor, the TDL query using a language parser, executing, by the processor, a tracking analysis based on the parsed TDL query, generating, by the processor, a tracking graph by cleaning a result of the tracking analysis, and outputting, by the processor and via an interface, query results based on the tracking graph.

First claim

What is claimed is:

1. A system for improving threat detection in a computer system by performing an inter-application dependency analysis on events of the computer system, comprising:
a memory device for storing program code;
a processor operatively coupled to the memory device and configured to perform the inter-application dependency analysis by executing program code stored on the memory device to:
receive a Tracking Description Language (TDL) query for performing a tracking analysis, the TDL query including general constraints for performing the tracking analysis, a tracking declaration specifying at least events of the computer system to be analyzed, and an output specification specifying a location for storing a tracking graph generated by the tracking analysis;
parse the TDL query using a language parser;
execute the tracking analysis based on the parsed TDL query by implementing a progressive tracking method to generate a result of the tracking analysis by:
splitting dependents of a given one of the events of the computer system into a plurality of execution windows with each of the execution windows being defined as a 3-tuple<begin, finish, e>, where begin is a starting time point, finish is an ending time point, and e is an event of interest, wherein the events of the computer system are used as edges in the tracking graph;
enumerating all events occurring in each of the execution windows; and
prioritizing the plurality of execution windows based on their respective ending time points;

generate a tracking graph by cleaning the result of the tracking analysis by removing all nodes that fail to meet constraints of the TDL query; and
output, via an interface, query results based on the tracking graph, the query results including at least one of the tracking graph and an optimized version of the tracking graph.

2. The system of claim 1 , further comprising program code stored on the memory device to:
pause the execution of the tracking analysis;
receive an updated TDL query; and
resume the execution of the tracking analysis based on the updated TDL query.

3. The system of claim 1 , further comprising program code stored on the memory device to execute the tracking analysis by adaptively parallelizing the progressive tracking method using a plurality of worker threads.

4. The system of claim 3 , wherein the progressive tracking method is adaptively parallelized in response to a determination that a number of events with a given depth exceeds a threshold.

5. The system of claim 1 , further comprising program stored on the memory device to generate the optimized version of the tracking graph by pruning the tracking graph to generate pruned results using one or more filters, and summarizing the pruned results.

6. The system of claim 5 , wherein the pruned results are summarized by merging nodes from the pruned results.

7. A computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method for improving threat detection in a computer system by performing an inter-application dependency analysis on events of the computer system, the method comprising:
receiving a Tracking Description Language (TDL) query for performing a tracking analysis, the TDL query including general constraints for performing the tracking analysis, a tracking declaration specifying at least events of the computer system to be analyzed, and an output specification specifying a location for storing a tracking graph generated by the tracking analysis;
parsing the TDL query using a language parser;
executing the tracking analysis based on the parsed TDL query, including implementing a progressive tracking method to generate a result of the tracking analysis by:
splitting dependents of a given one of the events of the computer system into a plurality of execution windows with each of the execution windows being defined as a 3-tuple<begin, finish, e>, where begin is a starting time point, finish is an ending time point, and e is an event of interest, wherein the events of the computer system are used as edges in the tracking graph;
enumerating all events occurring in each of the execution windows; and
prioritizing the plurality of execution windows based on their respective ending time points;

generating a tracking graph by cleaning the result of the tracking analysis, including removing all nodes that fail to meet constraints of the TDL query; and
outputting, via an interface, query results based on the tracking graph, the query results including at least one of the tracking graph and an optimized version of the tracking graph.

8. A computer-implemented method for improving threat detection in a computer system by performing an inter-application dependency analysis on events of the computer system, comprising:
receiving, by a processor operatively coupled to a memory, a Tracking Description Language (TDL) query for performing a tracking analysis, the TDL query including general constraints for performing the tracking analysis, a tracking declaration specifying at least events of the computer system to be analyzed, and an output specification specifying a location for storing a tracking graph generated by the tracking analysis;
parsing, by the processor, the TDL query using a language parser;
executing, by the processor, the tracking analysis based on the parsed TDL query, including implementing a progressive tracking method to generate a result of the tracking analysis by:
splitting dependents of a given one of the events of the computer system into a plurality of execution windows with each of the execution windows being defined as a 3-tuple<begin, finish, e), where begin is a starting time point, finish is an ending time point, and e is an event of interest, wherein the events of the computer system are used as edges in the tracking graph;
enumerating all events occurring in each of the execution windows; and
prioritizing the plurality of execution windows based on their respective ending time points;

generating, by the processor, a tracking graph by cleaning the result of the tracking analysis, including removing all nodes that fail to meet constraints of the TDL query; and
outputting, by the processor and via an interface, query results based on the tracking graph, the query results including at least one of the tracking graph and an optimized version of the tracking graph.

9. The computer-implemented method of claim 8 , further comprising:
pausing, by the processor, the execution of the tracking analysis;
receiving, by the processor, an updated TDL query; and
resuming, by the processor, the execution of the tracking analysis based on the updated TDL query.

10. The computer-implemented method of claim 8 , wherein executing the tracking analysis further includes adaptively parallelizing the progressive tracking method using a plurality of worker threads.

11. The computer-implemented method of claim 10 , wherein the progressive tracking method is adaptively parallelized in response to determining that a number of events with a given depth exceeds a threshold.

12. The computer-implemented method of claim 8 , further comprising generating the optimized version of the tracking graph.

13. The computer-implemented method of claim 12 , wherein generating the optimized version of the tracking graph further comprises pruning the tracking graph to generate pruned results using one or more filters.

14. The computer-implemented method of claim 13 , wherein generating the optimized

Assignees

• Nec Lab America Inc
• Nec Corp

Inventors

• Li Ding
• Jee Kangkook
• Chen Zhengzhang
• Tang Luan
• Li Zhichun

Classifications

• G06F16/248

  Presentation of query results · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F9/4881

  Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues · CPC title

• G06F16/2455

  Query execution · CPC title

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title