Computer implemented techniques for detecting, investigating and remediating security violations to IT infrastructure

Patent metadata

Field	Value
Publication number	US-9832217-B2
Application number	US-201414501976-A
Country	US
Kind code	B2
Filing date	Sep 30, 2014
Priority date	Mar 13, 2014
Publication date	Nov 28, 2017
Grant date	Nov 28, 2017

Abstract

A method includes collecting system calls and call parameters invoked by monitored applications for target computer systems. The system calls and call parameters are received from operating system kernels on the plurality of target computer systems. Sequences of systems calls and call parameters of the monitored applications are correlated among different target computer systems to deduce malicious activities. Remedial action(s) are performed in response to malicious activities being deduced as being malicious by the correlating. Another method includes determining that network activity at a specific time is deemed to be suspicious. Using IP addresses involved in the suspicious network activity, computer system(s) are determined that are sources of the suspicious network activity. Based on the specific time and the determined computer system(s), application(s) are determined that are executing on the determined computer system(s) that are causing the suspicious network activity. Remedial action(s) are performed for the determined computer system(s).

First claim

What is claimed is:

1. A method, comprising:
performing, by a computer system, an enforcement phase comprising:
collecting, by the computer system, system calls and call parameters invoked by monitored applications for each of a plurality of target computer systems, where the system calls and call parameters are received from operating system kernels on the plurality of target computer systems, where the operating system kernels have been instrumented to report system calls and call parameters invoked by the monitored applications, wherein the collecting in the enforcement phase collects from the target computer systems other security-sensitive activities selected from network connections, network bindings, process creations, and kernel module insertions;
correlating, by the computer system, sequences of systems calls and call parameters of the monitored applications among different target computer systems to determine violations in baseline patterns for the monitored applications that were learned during a learning phase performed prior to the enforcement phase, and therefore to deduce malicious activities, wherein the correlating in the enforcement phase correlates the other security-sensitive activities also to determine violations in baseline patterns for the monitored applications that were learned during the learning phase to deduce malicious activities; and
performing, by the computer system, one or more remedial actions in response to one or more activities being deduced as being malicious; and

wherein the learning phase that was performed prior to the enforcement phase determined the baseline patterns for the monitored applications for multiple observed computer systems, wherein the learning phase comprised:
collecting system calls and call parameters invoked by the monitored applications for each of the multiple observed computer systems; and
correlating sequences of systems calls and call parameters of the monitored applications among different multiple observed computer systems to determine the baseline patterns for the monitored applications.

2. The method of claim 1 , wherein at least one of the plurality of target computer systems comprises a user level monitoring application performing at least one of processing system calls locally or forwarding system calls to another set of local or remote monitoring applications.

3. The method of claim 1 , wherein the operating system kernels are run on the multiple observed computer systems and the plurality of target computer systems and wherein:
the observed and target computer systems further implement a transitive trust chain architecture;
the operating system kernels use the transitive trust chain architecture to monitor which executables, scripts, or libraries were run by users of a corresponding observed or target computer system; and
the operating system kernels report information about said executables, scripts, or libraries to the computer system for collecting and processing.

4. The method of claim 1 , further comprising recording in the learning phase reported system call invocations based on the monitored applications in a database in order to create the learned baseline patterns, wherein the correlating in the enforcement phase comprises correlating received reported system call invocations based on the monitored applications with recorded reported system call invocations based on the monitored applications from the database to deduce malicious activities.

5. The method of claim 1 , where executables, scripts, or libraries are acquired in the learning phase by crawling public software package repositories, the method comprising:
receiving a list of repositories to crawl;
logging into the repositories and walking a list of directories recursively;
comparing names and version information of packages found in said directories against known packages and package versions for the monitored applications in a database;
downloading those packages for the monitored applications that are not known;
extracting the files of those software packages on a system;
calculating checksums on said files; and
recording at least the checksums and file metadata of said files into a database used to determine the learned baseline patterns for the monitored applications.

6. The method of claim 1 , wherein:
collecting for the enforcement phase comprises receiving one or more values for hashes from one or more of the target computer systems;
correlating for the enforcement phase further comprises:
comparing the received one or more values of the hashes with values of hashes in one or more databases comprising the learned baseline patterns; and
deducing a malicious activity has occurred in response to the received one or more values of the hashes not corresponding to values of hashes in the one or more databases; and

performing for the enforcement phase one or more remedial actions comprises outputting an alert indicating the received one or more values of the hashes do not correspond to values of hashes in the one or more databases.

7. The method of claim 1 , wherein:
collecting for the enforcement phase comprises receiving a value for a key or its identifier from one or more of the target computer systems, the value of the key or its identifier corresponding to a particular monitored application;
correlating for the enforcement phase further comprises:
comparing the received value for the key or its identifier with values of keys or identifiers, respectively, in one or more databases comprising the learned baseline patterns; and
deducing a malicious activity has occurred in response to the received value of the key or its identifier not corresponding to values of keys or identifier in the one or more databases or the received value of the key or identifier not matching with a key or identifier in the one or more databases for the particular monitored application; and

performing one or more remedial actions comprises outputting an alert indicating the received key or identifier does not correspond to a key or identifier for the particular monitored application in the one or more databases.

8. The method of claim 1 , wherein at least one of the target computer systems comprises a virtual machine and wherein performing one or more remedial actions further comprises one of causing the virtual machine to be placed in a quarantine network, causing the virtual machine to be paused, or causing the virtual machine to be shutdown.

9. The method of claim 1 , wherein at least one of the target computer systems comprises a particular computer system and wherein performing one or more remedial actions further comprises causing the particular computer system to be isolated at least by causing blocking of network traffic to and from the particular computer system.

10. The method of claim 1 , wherein each of the multiple observed computer systems for the learning phase was assumed to be trustworthy at the beginning of the learning phase, and wherein collecting in the learning phase comprised receiving system calls and call parameters from operating system kernels on the multiple observed computer systems, where the operating system kernels have been instrumented to report system calls and call parameters invoked by the monitored applications.

11. The method of claim 1 , wherein the collecting in the enforcement phase collects from the target computer systems other security-sensitive activities comprising network connections, network bindings, process creations, and kernel module insertions.

12. The method of claim 11 , wherein the collecting in the enforcement phase collects from the target computer systems other security

Assignees

• IBM

Inventors

• Berger Stefan
• Chen Yangyi
• Hu Xin
• Pendarakis Dimitrios
• Rao Josyula
• Sailer Reiner
• Schales Douglas Lee
• Stoecklin Marc

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title