Using a threat model to monitor host execution in a virtualized environment

Patent metadata

Field	Value
Publication number	US-11295021-B2
Application number	US-201916575227-A
Country	US
Kind code	B2
Filing date	Sep 18, 2019
Priority date	Oct 4, 2016
Publication date	Apr 5, 2022
Grant date	Apr 5, 2022

Abstract

Approaches for monitoring a host operating system. A threat model is stored and maintained in an isolated execution environment. The threat model identifies for any process executing on a host operating system how trustworthy the process should be deemed based on a pattern of observed behavior. The execution of the process and those processes in a monitoring circle relationship thereto are monitored. The monitoring circle relationship includes a parent process, any process in communication with a member of monitoring circle relationship, and any process instantiated by a present member of monitoring circle relationship. Observed process behavior is correlated with the threat model. Upon determining that a particular process has behaved in a manner inconsistent with a pattern of allowable behavior identified by the threat model for that process, a responsive action is taken.

First claim

What is claimed is:

1. A non-transitory computer readable medium comprising instructions when executed cause a processor of a computing device to:
store and maintain a threat model in an isolated execution environment, the threat model identifies a pattern of allowable behavior for a process executing on a host operating process on a same machine as the isolated execution environment;
observe behavior with the isolated execution environment of monitored processes including a particular process and processes in a monitoring circle relationship with the particular process, the monitoring circle relationship including a parent process to the particular process, any process in communication with a member of the monitoring circle relationship, and any process instantiated by a member of the monitoring circle relationship, the monitoring circle relationship observed by virtue of the monitoring circle relationship with the particular process;
compare the observed behavior with the isolated execution environment of the monitored processes of the host operating system with the threat model within the isolated execution environment to identify allowable behavior for the monitored processes; and
based on a determination of a monitored process with the isolated execution environment of the monitored processes having an observed behavior inconsistent with the allowable behavior, take action with the isolated execution environment.

2. The non-transitory computer readable medium of claim 1 wherein the host operating system and the isolated execution environment execute together on the computing device.

3. The non-transitory computer readable medium of claim 1 wherein the threat model is maintained on the computing device.

4. The non-transitory computer readable medium of claim 1 wherein the threat model executes within the host operating system.

5. The non-transitory computer readable medium of claim 1 wherein the any process in communication with a member of the monitoring circle relationship includes any process that interacts with a member of the monitoring circle relationship.

6. The non-transitory computer readable medium of claim 1 wherein the allowable behavior includes a pattern of allowable behavior.

7. The non-transitory computer readable medium of claim 1 wherein the threat model identifies the monitored process having the having the observed behavior inconsistent with the allowable behavior.

8. The non-transitory computer readable medium of claim 1 wherein the instructions when executed cause the processor of the computing device to compare observed behavior of the monitored processes include instructions when executed cause the processor to generate data that describes a set of events that is supplied to the threat model.

9. The non-transitory computer readable medium of claim 1 wherein the isolated execution environment includes a virtual machine, a container, or a sandbox or the isolated execution environment is implemented in an enclave.

10. A computing device, comprising:
a processor; and
a memory to store a host operating system and to store a threat model in an isolated execution environment, the memory including instructions when executed cause the processor to:
store and maintain a threat model in an isolated execution environment;
observe behavior of monitored processes including a particular process and processes in a monitoring circle relationship with the particular process, the monitoring circle relationship including a parent process to the particular process, any process in communication with a member of the monitoring circle relationship, and any process instantiated by a member of the monitoring circle relationship, the monitoring circle relationship observed by virtue of the monitoring circle relationship with the particular process;
compare the observed behavior of the monitored processes of the host operating system with the threat model within the isolated execution environment to identify allowable behavior for the monitored processes; and
based on a determination of a monitored process of the monitored processes having an observed behavior inconsistent with the allowable behavior, take action with the isolated execution environment.

11. The computing device of claim 10 wherein the processor executes the host operating system.

12. The computing device of claim 10 further comprising a network card coupled to the processor to communicate over a network, wherein the isolated execution environment communicates over the network via the host operating system.

13. The computing device of claim 12 wherein the action includes notifying a central server over the network.

14. The computing device of claim 10 further comprising a network card coupled to the processor to communicate over a network, wherein the observed behavior includes network activity.

15. The computing device of claim 10 further comprising a persistent storage device coupled to the processor, wherein the observed behavior includes accesses to files or areas of the persistent storage device.

16. The computing device of claim 15 wherein the action includes encrypting data that describes events related to behaviors and storing the encrypted data on the persistent storage device.

17. A method to monitor an executing host operating system, the method comprising:
storing and maintaining a threat model in an isolated execution environment, the threat model identifies, for any process executing on a host operating system executing on a same machine as the isolated execution environment, a pattern of allowable behavior for the process;
observing behavior with the isolated execution environment of monitored processes of the executing host operating system, the monitored processes including a particular process and processes in a monitoring circle relationship with the particular process, the monitoring circle relationship including a parent process to the particular process, any process in communication with a member of the monitoring circle relationship, and any process instantiated by a member of the monitoring circle relationship;
comparing the observed behavior with the isolated execution environment of monitored processes of the host operating system with the threat model to identify allowable behavior for the monitored processes; and
based on a determination of the isolated execution environment that a monitored process of the monitored processes having an observed behavior inconsistent with the allowable behavior, taking action responsive to the observed behavior inconsistent with the isolated execution environment.

18. The method of claim 17 wherein the host operating system executes on a computing device and the threat model is maintained on the computing device.

19. The method of claim 17 wherein the comparing includes correlating the observed behavior with a model of allowable behavior of executable code, interpreted data, and user action with the threat model.

20. The method of claim 17 wherein the observing behavior includes observing behavior via introspection.

Assignees

• Hewlett Packard Development Co

Inventors

• Pratt Ian
• Kashyap Rahul
• Taylor Adrian
• Mckenzie James

Classifications

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title