Event-triggered behavior analysis

Patent metadata

Field	Value
Publication number	US-11295011-B2
Application number	US-201916242396-A
Country	US
Kind code	B2
Filing date	Jan 8, 2019
Priority date	Jan 8, 2019
Publication date	Apr 5, 2022
Grant date	Apr 5, 2022

Abstract

Certain aspects herein provide a system and method for performing behavior analysis for a computing device by a computing system. In certain aspects, a method includes detecting an event occurring at the computing device at a first time, determining, based on the detecting, an event category of the event, and collecting first one or more behaviors associated with the determined event category occurring on the computing device based. The method also includes comparing the first one or more behaviors with a dataset indicating one or more expected behaviors of the computing device associated with the event. Upon determining that at least one of the first one or more behaviors corresponds to an unexpected behavior based on the comparing, the method further includes taking one or more remedial actions.

First claim

What is claimed is:

1. A method of performing behavior analysis for a computing device by a computing system, comprising:
detecting an event occurring at the computing device at a first time;
determining, based on the detecting, an event category of the event, wherein the event category is associated with one or more types of behaviors, and wherein a different event category is associated with one or more different types of behaviors;
collecting first one or more behaviors of the one or more types of behaviors associated with the determined event category occurring on the computing device;
comparing the first one or more behaviors with a dataset indicating one or more expected behaviors of the computing device associated with the event, wherein the dataset was trained based on one or more past behaviors of the one or more types of behaviors collected from the computing device in association with one or more past events corresponding to the event category;
upon determining that at least one of the first one or more behaviors corresponds to an unexpected behavior based on the comparing, taking one or more remedial actions.

2. The method of claim 1 , further comprising:
detecting the event occurring at the computing device at a second time, wherein the first time is later than the second time;
determining the event category of the event;
collecting second one or more behaviors associated with the determined event category occurring on the computing device; and
training the dataset using the second one or more behaviors.

3. The method of claim 1 , wherein the event is user configurable.

4. The method of claim 1 , wherein:
collecting the first one or more behaviors is performed using a behavior collector process executing in an operating system of the computing device, and
detecting the event and determining the event category are performed using an event monitor process executing in an operating system of the computing device.

5. The method of claim 1 , wherein comparing the first one or more behaviors with the dataset comprises comparing the first one or more behaviors with the dataset using a one-class support vector machine (SVM) algorithm.

6. The method of claim 1 , wherein taking the one or more remedial actions comprises causing a remediation broker to take the one or more remedial actions.

7. The method of claim 6 , wherein the one or more remedial actions comprise causing a notification to be generated on a display associated with the computing device.

8. The method of claim 6 , wherein the one or more remedial actions comprise shutting down a process associated with the unexpected behavior.

9. The method of claim 1 , wherein the event category includes at least one of a process-related category, a network-related category, a memory-related category, a signal-related category, or a file-related category.

10. The method of claim 1 , wherein the first one or more behaviors include at least one of a process-related behavior, a network-related behavior, a memory-related behavior, a signal-related behavior, a usage-related behavior, a security-related behavior, or a file-related behavior.

11. An apparatus, comprising:
a non-transitory memory comprising instructions; and
a processor in data communication with the non-transitory memory and configured to execute the instructions to cause the apparatus to:
detect an event occurring at a computing device at a first time;
determine, based on the detecting, an event category of the event, wherein the event category is associated with one or more types of behaviors, and wherein a different event category is associated with one or more different types of behaviors;
collect first one or more behaviors of the one or more types of behaviors associated with the determined event category occurring on the computing device;
compare the first one or more behaviors with a dataset indicating one or more expected behaviors of the computing device associated with the event, wherein the dataset was trained based on one or more past behaviors of the one or more types of behaviors collected from the computing device in association with one or more past events corresponding to the event category;
upon determining that at least one of the first one or more behaviors corresponds to an unexpected behavior based on the comparing, taking one or more remedial actions.

12. The apparatus of claim 11 , wherein the processor is configured to execute the instructions to further cause the apparatus to:
detect the event occurring at the computing device at a second time, wherein the first time is later than the second time;
determine the event category of the event;
collect second one or more behaviors associated with determined event category occurring on the computing device; and
train the dataset using the second one or more behaviors.

13. The apparatus of claim 11 , wherein the event is user configurable.

14. The apparatus of claim 11 , wherein:
the processor is configured to execute the instructions to cause the apparatus to collect the first one or more behaviors through a behavior collector process executing in an operating system of the computing device, and
the processor is configured to execute the instructions to cause the apparatus to detect the event and determine the event category through an event monitor process executing in an operating system of the computing device.

15. The apparatus of claim 11 , wherein the processor being configured to cause the apparatus to compare the first one or more behaviors with the dataset further comprises the processor being configured to execute the instructions to cause the apparatus to compare the first one or more behaviors with the dataset using a one-class support vector machine (SVM) algorithm.

16. The apparatus of claim 11 , wherein the processor being configured to execute the instructions to take the one or more remedial actions further comprises the processor being configured to execute the instructions to cause a remediation broker to take the one or more remedial actions.

17. The apparatus of claim 16 , wherein the one or more remedial actions comprise causing a notification to be generated on a display associated with the computing device.

18. The apparatus of claim 16 , wherein the one or more remedial actions comprise shutting down a process associated with the unexpected behavior.

19. A non-transitory computer readable medium having instructions stored thereon that, when executed by a computing system, cause the computing system to perform operations comprising:
detecting an event occurring at a computing device at a first time;
determining, based on the detecting, an event category of the event, wherein the event category is associated with one or more types of behaviors, and wherein a different event category is associated with one or more different types of behaviors;
collecting first one or more behaviors of the one or more types of behaviors associated with the determined event category occurring on the computing device;
comparing the first one or more behaviors with a dataset indicating one or more expected behaviors of the computing device associated with the event, wherein the dataset was trained based on one or more past behaviors of the one or more types of behaviors collected from the computing device in association with one or more past events corresponding to the event category;
upon determining that at least one of the first one or more behaviors corresponds to an unexpected behavior based on the comparing, takin

Assignees

• Vmware Inc

Inventors

• Sun Ruimin
• Ganti Vijay
• Mo Zhen
• Zan Bin
• Akkineni Vamsi

Classifications

• G06F18/2433

  Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection · CPC title

• G06F18/2413

  based on distances to training or reference patterns · CPC title

• G06F18/2411

  based on the proximity to a decision surface, e.g. support vector machines · CPC title

• G06N3/045

  Combinations of networks · CPC title

• G06N3/0455

  Auto-encoder networks; Encoder-decoder networks · CPC title