Detecting anomalous behavior patterns in an electronic environment

Patent metadata

Field	Value
Publication number	US-9231963-B2
Application number	US-201414551819-A
Country	US
Kind code	B2
Filing date	Nov 24, 2014
Priority date	Mar 14, 2013
Publication date	Jan 5, 2016
Grant date	Jan 5, 2016

Abstract

The behavior of a group of resources, such as a fleet of servers, can be monitored to attempt to determine a baseline of acceptable behaviors. When a behavior is observed, the baseline can be consulted to determine whether the behavior is indicated to be acceptable. If not, the rate or extent at which the newly observed behavior is observed on groupings of similar resources can be monitored. This information can be used to determine whether the behavior is acceptable in which case information for the observed behavior can be used to automatically update the baseline such that the baseline is representative of current acceptable behavior within the group of resources.

First claim

What is claimed is:

1. A system for providing access to at least one host machine in a multi-tenant environment, comprising:
a plurality of host machines, each host machine including at least one processor and memory for storing instructions executable by the at least one processor;
at least one interface component enabling a user device to obtain access to at least one of the plurality of host machines; and
a monitoring component in communication with the plurality of host machines, the monitoring component configured to:
detect a change with respect to at least one of the host machines;
compare information for the change to a behavior baseline to determine whether the change matches an acceptable behavior, wherein at least a portion of acceptable behaviors are based at least in part upon data for purposeful behaviors observed within the plurality of host machines;
monitor related changes for at least a period of time, when the change does not match an acceptable behavior, to determine a rate or a prevalence of a type of the change;
compare information for the rate or prevalence to at least one corresponding parameter value for the baseline to determine whether the rate or prevalence falls within an expected parameter value range;
automatically add behavior information for the change to the baseline in response to the rate or prevalence falling within the expected parameter value range; and
generate a notification when the rate or prevalence falls outside the expected parameter value range.

2. The system of claim 1 , further comprising:
a management component configured to collect the information for the rate or prevalence and update the expected parameter range using the information.

3. The system of claim 1 , wherein the change includes at least one of a change in software, a change in configuration, or a change in communication flow.

4. The system of claim 1 , wherein the prevalence includes at least one of a number, a percentage, or a type of host machine to which the change occurs.

5. A computer-implemented method, comprising:
detecting a change in behavior affecting at least one resource in a plurality of electronic resources;
comparing information for the change in behavior to a behavior baseline, the behavior baseline reflecting acceptable behaviors for a substantially current state of the plurality of electronic resources, wherein at least a portion of the acceptable behaviors are based at least in part upon data for purposeful behaviors observed within the plurality of resources;
detecting related changes reflecting a prevalence of the change in behavior for at least a portion of the plurality of electronic resources;
determining whether the prevalence falls within parameter value ranges for one or more acceptable behaviors of the behavior baseline; and
adding information for the change in behavior to the behavior baseline when the prevalence falls within the parameter value ranges for the one or more acceptable behaviors.

6. The computer-implemented method of claim 5 , further comprising:
determining a type of the change in behavior, wherein the type of the change in behavior is selected from a group of behaviors includes at least one of a change in software version, a deployment of a new software package, a change in device configuration, a change in software configuration, a change in observed control plane traffic, a change in network data flow, a change in communication pattern, or a new communication pattern.

7. The computer-implemented method of claim 5 , further comprising:
performing an action when the prevalence falls outside the parameter value ranges.

8. The computer-implemented method of claim 7 , wherein the action includes at least one of generating a notification for at least one user associated with the plurality of electronic resources, generating an alarm, throttling communication between two or more of the resources, or suspending operation of at least one operation on at least one of the resources.

9. The computer-implemented method of claim 7 , wherein the prevalence includes at least one of a rate of occurrence of the behavior, a number of occurrences of the behavior, a type of electronic resource exhibiting the behavior, or a frequency of occurrences of the behavior.

10. The computer-implemented method of claim 5 , wherein at least a portion of the purposeful behaviors are specified by at least one user associated with the plurality of electronic resources.

11. The computer-implemented method of claim 5 , wherein at least a portion of the purposeful behaviors are determined based at least in part upon a pervasiveness of behaviors among the plurality of electronic resources.

12. The computer-implemented method of claim 5 , further comprising:
computing a velocity for the change in behavior, wherein the prevalence of the change in behavior falling outside the parameter value ranges for the one or more acceptable behaviors corresponds to the velocity for the change deviating by more than an allowable amount with respect for an average velocity for a type of the change as determined using the behavior baseline.

13. The computer-implemented method of claim 5 , further comprising:
receiving information for the change affecting the at least one resource from an activity monitor operating on at least one of the at least one resource.

14. The computer-implemented method of claim 5 , further comprising:
determining that a minimum percentage of the plurality of resources exhibits the change in behavior before updating the behavior baseline.

15. The computer-implemented method of claim 5 , further comprising:
generating the behavior baseline by training a baseline model using initial behavior data and observed behavior data from the plurality of resources.

16. A system, comprising:
a processor; and
a memory device including instructions that, when executed by the processor, cause the processor to:
monitor behavior of a plurality of electronic resources;
detect a change in behavior affecting at least one resource in the plurality of electronic resources;
determine whether the change in behavior is an acceptable behavior according to a behavior baseline;
if the change in behavior is not indicated as an acceptable behavior according to the behavior baseline:
determine a rate of related changes in behavior for at least a portion of the plurality of electronic resources;
compare information for the rate of related changes in behavior to parameter values for acceptable behaviors of the behavior baseline, wherein at least a portion of the acceptable behaviors are based at least in part upon data for purposeful behaviors observed within the plurality of resources; and
automatically add information for the change in behavior to the baseline as corresponding to an acceptable behavior in response to the rate of related changes in behavior falling within acceptable parameter value ranges for one or more acceptable behaviors of the behavior baseline.

17. The system of claim 16 , wherein the instructions when executed further cause the processor to:
perform an action when the rate of related changes in behavior falls outside the acceptable parameter value ranges.

18. The system of claim 17 , wherein the instructions when executed further cause the processor to:
determine a type of the change in behavior; and
determine the action to perform based at least in part upon the type of the change in behavior.

19. The system of claim 16 , further comprising:
at least one monitoring compo

Assignees

• Amazon Tech Inc

Inventors

• Dokey Aaron Douglas
• Searle Ian Roger
• Brandwine Eric Jason

Classifications

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title