Cloud security monitoring of applications in paas services

Patent metadata

Field	Value
Publication number	US-2022060490-A1
Application number	US-202016999614-A
Country	US
Kind code	A1
Filing date	Aug 21, 2020
Priority date	Aug 21, 2020
Publication date	Feb 24, 2022
Grant date	—

Abstract

A security threat detection system is used to monitor the physical resource usage of a hosted application in a PaaS service in order to detect anomalous behavior indicative of a security threat. The system analyzes the historical usage of the application's physical resources in order to determine the normal range of consumption of a resource by the application. A security threat alert is then provided when the application's resource consumption exceeds the normal range of consumption.

First claim

What is claimed:

1 . A system comprising:
one or more processors; and a memory that stores one or more programs that are configured to be executed by the one or more processors, the one or more programs including instructions that: host an application as a Platform-as-a-Service (PaaS) web service in a virtual machine using virtual resources, the PaaS web service unaware of physical resources associated with the virtual resources; obtain an application usage profile for the PaaS web service, the application usage profile having one or more statistics, a statistic representing normal consumption of a physical resource used by the PaaS web service; monitor runtime usage of a first physical resource during execution of the PaaS web service; correlate the first physical resource to a corresponding virtual resource used during operation of the PaaS web service via a process identifier of the PaaS web service; compare the runtime usage of the first physical resource with a corresponding statistic; and upon the comparison indicating an anomaly, initiate a warning of the anomaly.

2 . The system of claim 1 , wherein the one or more programs include further instructions that:
obtain historical resource consumption of the PaaS web service; derive a threshold for one or more of the physical resources consumed by the PaaS web service; and store the threshold in the application usage profile for the PaaS web service.

3 . The system of claim 1 , wherein the one or more programs include further instructions that:
obtain historical resource consumption of the PaaS web service; cluster the historical resource consumption into one or more clusters for the first physical resource; compute a centroid for the first physical resource; and store the centroid in the application usage profile for the PaaS web service.

4 . The system of claim 1 , wherein the application usage profile includes one or more of processor consumption, memory consumption, number and types of disk I/O events, number of network packets transmitted, frequency of network packets transmitted, largest size of network packets transmitted, Internet Protocol (IP) addresses used in network packets transmitted, or identity of open ports.

5 . The system of claim 1 , wherein the statistic includes a threshold for the first physical resource,
wherein the one or more programs include further instructions to detect when the threshold for the first physical resource is exceeded during runtime usage of the PaaS web service.

6 . The system of claim 1 , wherein the one or more programs include further instructions that:
detect the anomaly when the runtime usage of the first physical resource exceeds a distance from a centroid representing normal usage consumption of the first physical resource.

7 . The system of claim 1 , wherein the statistic is derived from runtime usage of the first physical resource during multiple instances of the PaaS web service.

8 . The system of claim 7 , wherein the multiple instances of the PaaS web service operate on different virtual machines in different servers.

9 . A computer-implemented method, comprising:
configuring an application as a Platform as a Service (PaaS) web service in a virtual machine with virtual resources, wherein the PaaS web service is isolated from identity of physical resources consumed by the PaaS web service; during a training period, monitoring usage of the physical resources consumed by the PaaS web service; correlating the virtual resources used by the application to corresponding physical resources using a process identifier of a process hosting an instance of the PaaS web service; generating a mathematical model of normal resource consumption of at least one physical resource consumed by the PaaS web service; using the mathematical model during runtime execution of the PaaS web service to detect abnormal behavior in runtime resource consumption of the at least one physical resource by the PaaS web service; and generating an alert when the abnormal behavior is detected.

10 . The computer-implemented method of claim 9 , further comprising:
monitoring resource usage of the PaaS web service across all instances of the PaaS web service.

11 . The computer-implemented method of claim 9 , further comprising:
monitoring processor consumption and memory consumption of the PaaS web service.

12 . The computer-implemented method of claim 9 , further comprising:
monitoring features of network usage of the PaaS web service, the features including a number of network packets transmitted, sizes of the network packets transmitted, open ports, and Internet Protocol (IP) addresses used.

13 . The computer-implemented method of claim 9 , further comprising:
monitoring features of disk I/O usage of the PaaS web service, the features including identity of files accessed and a number of I/O operations made.

14 . The computer-implemented method of claim 9 , wherein the mathematical model of the normal resource consumption of the at least one physical resource consumed by the PaaS web service is derived from historical resource usage of the at least one physical resource by the PaaS web service during the training period.

15 . The computer-implemented method of claim 9 , wherein the mathematical model of normal resource consumption of the at least one physical resource consumed by the PaaS web service is derived from clustering historical resource usage of the at least one physical resource by the PaaS web service during the training period.

16 . A device, comprising:
one or more processors and a memory; the memory including a virtual machine configured to:
execute a Platform as a Service (PaaS) web service in the virtual machine, the PaaS web service utilizing virtual resources with no visibility to associated physical resources;
obtain normal usage data of the physical resources used by the PaaS web service;
extract runtime usage data of at least one physical resource used by the PaaS web service by mapping a virtual resource corresponding to the at least one physical resource through a process identifier of a process running an instance of the PaaS web service application on the virtual machine; and
determine a security threat when the runtime usage data of the at least one physical resource exceeds the normal usage data of the at least one physical resource.

17 . The device of claim 16 , wherein the virtual machine is further configured to:
analyze historical resource usage data of a first physical resource used by the PaaS web service to generate a threshold; and detect the security threat when the runtime usage data for the first physical resource exceeds the threshold.

18 . The device of claim 16 , wherein the virtual machine is further configured to:
analyze historical resource usage data of the first physical resource to generate a centroid representing a measurement value of normal behavior of the fist physical resource when used by the application; and detect the security threat when the runtime usage data for the first physical resource exceeds a distance from the centroid.

19 . The device of claim 16 , wherein the normal usage data represents processor consumption, memory consumption, number of network packets transmitted, frequency of network packets transmitted, number of disk I/O events, largest size of network packets transmitted, Internet Protocol (IP) addresses used in network packets transmitted, and/or identity of open ports.

20 . The d

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Farshteindiker Benyamin
• Israel Assaf
• Weinberger Tomer

Classifications

• G06F2201/81

  Threshold · CPC title

• G06F11/3447

  Performance evaluation by modeling · CPC title

• G06F11/302

  where the computing system component is a software system · CPC title

• G06F2201/865

  Monitoring of software · CPC title

• G06F11/3006

  where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50) · CPC title