Instruction monitoring for dynamic cloud workload reassignment based on ransomware attacks

Abstract

Current embodiments relate to identifying ransomware attacks. One embodiment relates to a method that includes configuring an operating system to collect metrics related to hardware components. A message may be received from a user space library to verify an instruction detected in a cache, the instruction associated with a hardware component. The metric may be compared to a threshold amount. The metric may be associated with a hardware component. A likelihood of a ransomware attack may be determined based at least in part on the comparison. A message including the determination of the likelihood of the ransomware may be communicated to a user space library.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Non-Provisional Application No. 17 / 743,945, filed on May 13, 2022; the contents of which are incorporated herein by reference in their entirety for all purposes. Technical Field

[0003] The present application relates to the field of network security, and more particularly to instruction monitoring for dynamic cloud workload reallocation based on ransomware attacks Background Art

[0004] The cloud computing environment includes a combination of a cloud computing infrastructure layer, a cloud platform layer, and an application layer. Each of these layers also includes sub-elements to allow the cloud computing system to deliver services to its customers. Each of these cloud computing layers and elements can provide opportunities for bad actors to defeat security measures and compromise the operation of the cloud computing environment. Summary of the invention

[0005] The present embodiments relate to dynamic cloud workload reallocation based on active ransomware attacks. A first example embodiment provides a computer-implemented method for dynamic cloud workload reallocation. The method may include configuring an operating system to collect metrics related to hardware components.

[0006] The computer-implemented method may also include receiving a message from a user space library to validate an instruction detected in a cache, the instruction being associated with a hardware component.

[0007] The computer-implemented method may also include comparing the metric to a threshold metric, the metric associated with the hardware component and based at least in part on the message.

[0008] The computer-implemented method may also include determining a likelihood of a ransomware attack based at least in part on the comparison.

[0009] The computer-implemented method may also include transmitting a message to the user space repository including the determination of the likelihood of ransomware.

[0010] A second embodiment relates to a cloud infrastructure node. The cloud infrastructure node may include a processor and a non-transitory computer-readable medium. The non-transitory computer-readable medium may include instructions that, when executed by the processor, cause the processor to configure an operating system to collect metrics related to hardware components.

[0011] The instructions may also cause the processor to receive a message from a user space library to validate an instruction detected in a cache, the instruction being associated with a hardware component.

[0012] The instructions may also cause the processor to compare the metric to a threshold metric, the metric associated with the hardware component and based at least in part on the message.

[0013] The instructions may also cause the processor to determine a likelihood of a ransomware attack based at least in part on the comparison.

[0014] The instructions may also cause the processor to transmit a message to the user space library including the determination of the likelihood of ransomware.

[0015] A third embodiment relates to a non-transitory computer-readable medium. The non-transitory computer-readable medium may include a sequence of instructions stored thereon, which, when executed by a processor, causes the processor to perform a process. The process may include configuring an operating system to collect metrics related to a hardware component.

[0016] The process may also include receiving a message from a user space library to verify an instruction detected in a cache, the instruction being associated with a hardware component.

[0017] The process may also include comparing the metric to a threshold metric, the metric associated with the hardware component based at least in part on the message.

[0018] The process may also include determining a likelihood of a ransomware attack based at least in part on the comparison.

[0019] The process may also include transmitting a message to user space including a determination of the likelihood of ransomware. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 is a block diagram of a system for ransomware detection in a cloud infrastructure environment, according to at least one embodiment.

[0021] Figure 2 is a block diagram of a resurfacing system according to at least one embodiment.

[0022] Figure 3 is a signaling procedure for a memory sweeping procedure in accordance with at least one embodiment.

[0023] Figure 4 is a block diagram of a memory system according to at least one embodiment.

[0024] Figure 5 is a block diagram of a process for ransomware detection according to at least one embodiment.

[0025] Figure 6 is a block diagram of a process for ransomware detection according to at least one embodiment.

[0026] Figure 7is a block diagram of a process for ransomware detection according to at least one embodiment.

[0027] Figure 8 is a block diagram illustrating a pattern for implementing a cloud infrastructure as a service system according to at least one embodiment.

[0028] Fig. 9 is a block diagram illustrating another mode for implementing a cloud infrastructure as a service system according to at least one embodiment.

[0029] Fig.10 is a block diagram illustrating another mode for implementing a cloud infrastructure as a service system according to at least one embodiment.

[0030] Fig.11 is a block diagram illustrating another mode for implementing a cloud infrastructure as a service system according to at least one embodiment.

[0031] Fig.12 is a block diagram illustrating an example computer system in accordance with at least one embodiment. DETAILED DESCRIPTION

[0032] In the following description, various embodiments will be described. For the purpose of explanation, specific configurations and details are explained in order to provide a thorough understanding of the embodiments. However, it will be clear to those skilled in the art that the embodiments can be practiced without these specific details. In addition, well-known features can be omitted or simplified in order not to make the embodiments being described unclear.

[0033] Many cloud computing systems are susceptible to active security exploits, such as through ransomware attacks. Ransomware attacks can include malicious memory / disk encryption using secret keys. In addition, ransomware attackers can encrypt customer data and hold that data for ransom. Failure to pay the ransom can result in the deletion of customer data or inappropriate dissemination of customer data.

[0034] Ransomware attacks have evolved to the point where many attacks can bypass standard anti-virus protection. In addition, ransomware can be designed to attack specific targets, such as hardware components of cloud computing systems. Two such ransomware attacks include full disk encryption and damage to object level authorization (BOLA). Laptops and servers are particularly susceptible to these hardware-level ransomware attacks. Once a laptop or server connected to a cloud environment is successfully attacked by ransomware, the laptop or server becomes a gateway for malicious parties to cause further damage to the cloud system.

[0035] The embodiments described herein address the above-mentioned problems by using cloud computing technology to handle hardware-level ransomware methods. Specifically, the embodiments described herein can handle ransomware by connecting advanced microprocessor instruction set classes to cloud computing technology. In other words, cloud technology is connected to the instruction set at the hardware level. In addition, the embodiments herein are superior to previous methods of handling ransomware by connecting resurfacing and migration services to address the security threats posed by ransomware.

[0036] Embodiments herein may provide monitoring solutions at a low-level processing space whenever a specific microprocessor-level instruction is executed to start. Embodiments may also provide a set of middle-layer services and a solution library for utility functions. In addition, embodiments may provide a glue logic function that connects and / or transforms memory-mapped monitoring products into key performance indicators (KPIs) input to a cloud-native scheduler. Embodiments may also allow modifications to algorithms used in workload migration from one group of cloud computing instances to other groups. In addition, embodiments may allow freezing of victim computing instances. The embodiments described herein provide advantages over previous ransomware processing methods. For example, embodiments provide control over regions in a cloud computing system that implements embodiments. In addition, ransomware can be removed at the microprocessor level.

[0037] Figure 1 1 is a block diagram illustrating an example system 100 for identification and mitigation of ransomware in a cloud computing infrastructure 102. The system 100 may include an instruction detector 104 for detecting and monitoring encryption / decryption of assembly instructions at a kernel level. The instruction detector 104 may detect and monitor encryption instructions, for example, when instructions are read from memory into an instruction cache or when assembly level instructions are executed. The instruction detector 104 may include low-level memory monitoring resources to detect encryption / decryption instructions. The instruction detector 102 may read a memory line to identify any encryption instructions being provided to the memory. The encryption / decryption instructions may be aggregated to determine whether a threshold number of changes have occurred in the memory to verify a ransomware attack at the memory.

[0038] System 100 may also include a user space library 106 at a user space in a cloud infrastructure, which may initiate monitoring of low-level memory. User space library 106 may be a collection of functions that enable communication between an operating system and an application executed on the operating system. In some embodiments, user space library 106 may be reused across libraries at the platform layer of a cloud environment. User space library 106 may detect and monitor encryption / decryption instructions being read into an instruction cache. The instruction cache stores instructions that low-level hardware is about to execute. Specifically, user space library 106 may monitor instructions being read into an instruction cache and determine whether there are any changes to the instructions. As an illustration, instruction detector 104 may detect and monitor encryption / decryption routines at the kernel level. User space library 106 may detect and monitor encryption / decryption routines at the user space level.

[0039] The system 100 may also include a memory translator 108. The memory translator 108 may interact with the memory map to provide cache mapping and unmapping functions to the application. Each time an application is introduced into the cloud to a cloud computing instance, the application provides a set of instructions for interacting with the hardware. The memory translator 108 may guide the application according to, for example, a placement policy and a replacement policy, as well as a read and write policy for the instructions provided by the application.

[0040] System 100 may interact with application 110. Application 110 may potentially include ransomware that maliciously encrypts data within a cloud computing infrastructure.

[0041] The embodiments described herein provide various functionalities. One functionality is timer-based polling of the instruction cache. As described above, the user space library 106 can detect and monitor encryption / decryption instructions as they are transmitted to or from the instruction cache. In some embodiments, the system 100 monitors the instruction cache at periodic or aperiodic configurable time intervals. The system 100 can configure the time interval to decrease or increase. Therefore, if the system 100 determines that the length of the time interval should be increased to monitor the instruction cache, it can increase the time interval. On the other hand, the user space library 106 can also reduce the length of the time interval.

[0042] Another feature of the embodiments described herein is an optimized dynamic random access memory (DRAM) scan detection threshold for the detection method described herein. The system 100 can scan the DRAM for encryption / decryption verification of assembly instructions. The scan can provide information related to determining when an instruction is effectively encrypted or maliciously encrypted. Specifically, the scan can also provide information related to determining the weights of the scoring algorithm described below and whether the cloud computing system is behaving normally or abnormally.

[0043] Another feature of the embodiments described herein is the ability to register a host instance to a resurfacer and connect the host instance to the resurfacer. The resurfacer can be a cloud native resurfacer, which can be a microservice specifically built for a cloud computing environment and updated periodically. The embodiment can also analyze system parameters to determine at what level the resurfacing is performed. For example, resurfacing can be performed on different system levels, for example, host level, container level, distribution point (POD) level.

[0044] refer to Figure 2 , a resurfacing system 200 for migrating computing resources (e.g., or workloads) from an infected computing instance and issuing a request to perform a computing task is shown. Resurfacing may include restoring the state of an instance to a state before a security breach. For example, if ransomware has been introduced into a workload, a resurfacing device 202 may restore the state of the workload. The resurfacing device 202 may include a host-level resurfacing device 204 for resurfacing resources at the host level and a container-level resurfacing device 206 for resurfacing resources at the container level. The host-level resurfacing unit 204 may include a workload migration unit 208 for resurfacing a workload from an infected computing instance at the host level. In addition, the host-level resurfacing unit 204 may include a restart host image unit 210 for resurfacing a host image for an infected computing instance. The container-level resurfacing unit 206 may include a workload migration and pod migration module 212 for resurfacing a workload from an infected computing instance.

[0045] refer to Figure 3 , a signaling diagram 300 for registration / deregistration of encrypted assembly instruction monitoring. As shown, a user space library 302, an instruction detector 304, a kernel image 306, and a logging service 308 can interact with each other. Although the operations of processes 300, 500, 600, and 700 are described as being performed by a general-purpose computer, it should be understood that any suitable device (e.g., a user device, a server device) can be used to perform one or more operations of these processes. Processes 300, 500, 600, and 700 (described below) are illustrated as logic flow diagrams, respectively, and each operation of the logic flow diagram represents a sequence of operations that can be implemented in hardware, computer instructions, or a combination thereof. In the context of computer instructions, an operation represents a computer executable instruction stored on one or more computer-readable storage media, which, when executed by one or more processors, performs the recorded operation. Typically, computer executable instructions include routines, programs, objects, components, data structures, etc. that perform functions or implement data types. The order in which the operations are described is not intended to be interpreted as a limitation, and any number of described operations can be combined in any order and / or in parallel to implement the process.

[0046] At 310, the user space library 302 can insert the kernel level detection instruction into the instruction detector 304. The user space library 302 may include, for example, a user space library, and the user space library 302 may retrieve the detection instruction for how to detect encryption / decryption from the library and insert the detection instruction into the instruction detector 304. The detection instruction may include a kernel driver, which may have the ability to directly access the kernel application programming interface (API) and memory. The user space library 302 may be triggered to retrieve and insert the detection instruction based on the interaction with the application. The application may be, for example, an application that has been potentially infected by ransomware.

[0047] At 312, the instruction detector 304 can insert the detection instruction into the kernel image. In some embodiments, the instruction detector 304 can insert the detection instruction into the kernel tree, which can be a source directory or repository containing kernel sources. Steps 310 and 312 can result in the insertion of the detection instruction at the core processor level.

[0048] At 314, the user space library 302 can monitor instructions (such as assembly level instructions) loaded into or retrieved from a cache (such as an instruction cache). The instructions can be assembly level instructions that are transferred to the cache based on the application and are related to the hardware. The user space library 314 can also monitor assembly instructions for memory mapping changes. Memory mapping can be a process by which the contents of the main memory are brought to a cache such as an instruction cache. Memory mapping can also include a process by which blocks of the main memory are mapped to the cache in the event of a cache miss. Changes in the memory map can indicate changes in mappings from retrieval of compliant instructions from the self-memory, as well as retrieval of encrypted instructions that may result in malicious.

[0049] If the user space library 302 detects a change to the assembly instruction mapping at the cache level, it can request the instruction detector at 316 to check the mapped assembly instructions. At 318, the instruction detector 304 can transmit a message to configure the kernel image 306 for the collection of metrics. The kernel image can be a binary form of an operating system. For example, the instruction detector 304 can configure a central processing unit (CPU), a graphics processing unit (GPU) for the collection of metrics at the hardware level.

[0050] At 320, instruction detector 304 may register a callback function to provide a callback to user space library 302 when one or more collected metrics exceed a threshold. A callback may be executable code passed as an argument to another piece of code. A callback may also provide a message to a high-level function (e.g., a user space library) to perform some post-processing of the collected metrics.

[0051] At 322, kernel image 306 may return hardware metrics to instruction detector 304. The hardware metrics may be retrieved from a plurality of hardware-related sources. The hardware metrics may be continuously received by instruction detector 304 and from kernel image 306. Instruction detector 304 may continuously compare the hardware metrics to one or more thresholds. The thresholds may be related to key performance indicators (KPIs). Instruction detector 304 may perform the comparison to identify instructions in the cache that are related to ransomware.

[0052] At 324, the instruction detector 304 may send a notification to the user space library 302 that the instruction may be problematic. For example, an assembly instruction may be associated with a malicious encryption instruction. The notification may be included in the callback mentioned above. In response to receiving the notification, the user space library 302 may begin post-processing for recording the incident. For example, the user space library 302 may begin updating key performance indicators (KPs), updating hardware device footprints, identifying which memory mappings have been updated, and identifying any generated products. The user space library 302 may also add timestamps to the collected data and store it in buckets.

[0053] At 326, the instruction detector 304 can transmit a notification to the logging service 308 that the metric exceeds the threshold. The instruction detector 304 can also indicate that the user space library 302 is triggered to perform post-processing of the collected data related to the potential ransomware incident at the hardware level. In other examples, the instruction detector 304 can transmit a notification of failure. This prompts the user space library 302 to transmit a request to check a specific assembly instruction, and the instruction detector began to collect metrics, but did not exceed the threshold.

[0054] At 328, the user space library 302 may transmit a notification to the instruction detector 304 regarding whether the memory is erased. Figure 2 As shown in , system 100 allows resurfacing of an instance compromised by ransomware. Resurfacing can include returning an instance from a compromised state to a previous state. For example, resurfacing device 200 can reload an image of an instance, wherein the reloaded image is in a state before the ransomware attack. The state can be that the instance has not been resurfaced, is in the process of being resurfaced, or has been resurfaced.

[0055] As described above, cache instructions can be identified at the microprocessor level and may be the result of a ransomware attack. In some embodiments, assembly instructions that may be related to ransomware are identified at the cache level. The identified instructions can be compared with certain KPIs to determine whether the instructions are related to ransomware. A mathematical formula using a weighted average can be implemented to dynamically distinguish between compliant and malicious encryption instructions. Each instruction can be weighted according to the likelihood that the instruction is related to a ransomware attack. The following example table provides a description of each instruction and the weight of each instruction.

[0056] instruction describe The weight of each AESENC Perform one round of AES encryption flow 0.25 AESENCLAST Execute the last round of AES encryption flow 0.25 AESDEC Perform one round of AES decryption flow 0.25 AESDECLAST Execute the last round of AES decryption flow 0.25 AESKEYGENASSIST Assists in AES round key generation 0.1 AESIMC Assisting AES 0.1

[0057] Each identified instruction is associated with a bucket of encryption / decryption instruction types. A description of the instruction class is provided, and a weight for the instruction type is also provided. The weight may be an indication of the likelihood that the instruction is associated with ransomware if the instruction class is identified in the cache. It should be understood that the above table is for illustrative purposes only, and that the instruction class, description, and weight may be any instruction specific to the situation. For example, a processor may have one architecture and use one set of instruction classes, while another processor may have a different architecture and use another set of instruction classes.

[0058] In some embodiments, the user space library may implement functionality to apply the following formula to identify instructions associated with ransomware: Total weight = sum of (frequency of each instruction class * weight of each instruction class) (e.g., total weight = [((frequency of first instruction class)(weight of first instruction class))+((frequency of second instruction class)(weight of second instruction class))]). As described above, the cache may be monitored over a configurable time window. During the time window, each instruction type may be logged. The user space library may then aggregate instructions based on instruction type and the frequency of a particular instruction. The user space library may multiply the frequency of instructions based on instruction type to calculate a total weight. The total weight may be compared to a KPI to determine whether the presence of an instruction indicates a ransomware attack.

[0059] As described above, the detection instructions related to encryption / decryption in the memory group can be aggregated to determine whether there is a ransomware attack. In response to identifying that there may be a ransomware attack, a trigger can be created to initiate a resurfacing to migrate resources from the victim computing instance.

[0060] In some embodiments, a user space library may create a table for hardware that is a potential victim of a ransomware attack. The user space library may add metadata related to the hardware to the table. The metadata may be various values ​​from the hardware configured into the kernel image. The metadata is configured into a known pattern and compared to known values, such as ground truth. The user space library may traverse the table and compare the metadata to the known values. For example, the process may be configured as a "while" loop, where the middle portion continues to perform comparisons until no metadata is compared to a known value.

[0061] A memory group including instruction instances identified in a memory row may be obtained. The memory group may be processed using a ransomware detection structure to detect instructions associated with ransomware and determine whether the instructions include temporary encryption that may contain a ransomware attack or include persistent encryption. Each memory row may be accessed according to a specific order. For example, the content in the first row may be read and saved with the previous row and the subsequent row. After reading / writing a block of rows, the previous row and another subsequent row may be read according to the order.

[0062] In response to not detecting any instructions related to encryption, the result can indicate that no encryption was detected. Alternatively, if an instruction to encrypt data is detected, then a change in the memory content of each block of the memory row can be calculated. The result can be compared to a threshold to determine whether the instruction exceeds a threshold amount. In addition, the result can be processed to determine whether the instruction includes a false positive. In response to the result being confirmed, the result indicates that a ransomware attack may occur, a trigger can be created for a resurfacing of the victim computing instance.

[0063] In some instances, instructions for encrypting and decrypting data can be analyzed via a cryptographic degree graph to verify the results and remove false positive instances of possible ransomware attacks identified. As described above, the user space library can observe the cache over a configurable time window. For example, the user space library can observe data written to or read from the cache over a three-second time window. The user space library can also retrieve historical data from the cache over a similar time window. Assuming that no malicious encryption was observed at the time, the historical data serves as a benchmark for the current data. The user space library can compare two data sets and determine whether there are differences (e.g., changes) between the two data sets that suggest malicious encryption has occurred.

[0064] In some embodiments, a cryptographic degree map can be generated to include a bitmap of instructions identified for each memory row. A mathematical exclusive or (XOR) operation for the bitmap can be performed for adjacent memory rows. The variation value can be derived as the result of the XOR operation for each group of adjacent bitmaps, and the sum of the variation values ​​can be derived by aggregating the variation values. If the sum of the variation values ​​summed exceeds the threshold, encryption / decryption can be identified. Alternatively, the system can continue to accumulate instructions identified in the memory group. In some instances, data analysis functions (such as minimum, maximum, standard deviation) can be used to obtain possible threshold variants.

[0065] refer to Figure 4 , shows an example instruction cache system 400 according to one or more embodiments. As shown, memory 402 can provide instructions to instruction cache 404 and data to data cache 406. Processor core 408 can receive instructions from instruction cache 404 and receive data for use during the execution of instructions from data cache 406. Processor core 408 can return modified or unmodified data back to data cache 406, and data cache 406 can return data to memory 402. When processor core 408 is ready to execute the next instruction, it retrieves the next instruction from instruction cache 404. When new instructions are needed, new instructions can be written into instruction cache 404 from memory 402. This is a continuous process, and therefore the instructions currently in instruction cache 404 can be different based on the time when instruction cache 404 is observed. As described above, each instruction in instruction cache 404 at any given moment can belong to a corresponding instruction class and can be assigned a weight based on the class. In addition, each instruction may be an instruction for malicious encryption.

[0066] As described above, the instruction cache 404 can be observed over a configurable window. This includes instructions being read from the memory 402 and written to the instruction cache. This also includes instructions currently stored in the instruction cache 404 and instructions read by the processor core 408 for execution. Since the state of the instruction cache 404 is a function of time, the embodiments described herein include a configurable time window for observing the instruction cache 404. Therefore, the system 100 can configure the time associated with the window for observation of the instruction cache. For example, if the window is configured to X milliseconds (ms), the system 100 can observe the instruction cache X ms. However, if the system configures the window to Y ms, the system 100 can observe the instruction cache Y ms. The system 100 can configure the window based on the optimal window to identify whether malicious instructions are being received at the instruction cache 404.

[0067] Figure 5 A process 500 for identifying a ransomware attack according to some embodiments is illustrated. At 502, a computing device may transmit a detection instruction to an instruction detector. The computing device may include, for example, a node of a cloud infrastructure system. The node may include a user space library that manages communications between an application and a cloud infrastructure device. The computing device may transmit the detection instruction in response to detecting an interaction between an application and a cloud infrastructure device.

[0068] At 504, the computing device may monitor a cache such as an instruction cache to detect changes in a memory map. The memory map may be a map of instructions written into the instruction cache and memory from which the instructions are read. The instructions may be assembly level instructions for hardware. The computing device may monitor the cache over a configurable window.

[0069] At 506, the computing device may determine whether it detects any changes to the memory map. If no changes to the memory map are detected, process 500 returns to 504, at which point the persistent device continues to monitor the cache. However, if the computing device detects changes to the memory map, process 500 proceeds to 508.

[0070] At 508, the computing device may transmit a message to check for instructions. The message may be transmitted to an instruction detector, and the instructions to be checked may be instructions related to changes in the memory map. For example, if the memory map initially indicated that the cache was set to retrieve instructions from one location in memory, and then the mapping was changed to retrieve instructions from another location, the computing device may request to check those instructions.

[0071] At 510, the computing device may receive a message indicating whether a ransomware attack has occurred. The message may be received as a callback and from the instruction detector. If the message indicates a ransomware attack, the computing device may resurface the infected instance at 512. However, if the message does not indicate a ransomware attack, the computing device does not resurface the instance.

[0072] Figure 6 A process 600 for identifying a ransomware attack according to some embodiments is illustrated. At 602, a computing device may receive a detection instruction. The computing device may be a node of a cloud infrastructure system. The node may also include an instruction detector. The detection instruction may include a kernel driver. At 604, the computing device may insert the detection instruction into a kernel image. The kernel image may include an operating system of a cloud computing infrastructure (e.g., a non-Linux-based system). The detection instruction may be used to configure the kernel image for the collection of metrics related to the detection of a ransomware attack.

[0073] At 606, if the threshold is reached, the computing device may register a callback function. The callback function may be configured to send a message to the user space library that the threshold has been exceeded. The message may also be a message to the user space library to start a post-processing step.

[0074] At 608, the computing device may compare the collected metrics to thresholds. The metrics may be collected by a kernel image (or an operating system other than a Linux-based system). The thresholds may be based on configurable KPIs provided to the computing device.

[0075] At 610, the computing device may transmit a notification to the user space library. The notification may be based on a callback function. The notification may include a message that a ransomware attack has occurred, or the notification may be a message that no ransomware attack has occurred. Before sending the notification, the computing device may determine whether the message of the ransomware attack is a false positive. For example, if the collected metrics exceed one or more thresholds, and after analysis for false positives, the computing device may transmit a message that a ransomware attack has been detected. However, if the collected metrics do not exceed any thresholds, the computing device may transmit a message that no ransomware attack has been detected.

[0076] Figure 7 is a block diagram of a process for ransomware detection according to at least one embodiment. At 702, a method may include configuring an operating system of a computing device to collect metrics related to a hardware component. The computing device may be, for example, a cloud infrastructure node. The metrics may be collected by a kernel image (or an operating system that is not based on a Linux system).

[0077] At 704, the method may include a computing device receiving a message from a user space library to verify an instruction detected in a cache, the instruction associated with the hardware component. The cache may include, for example, an instruction cache, and the instruction cache may include, for example, assembly instructions.

[0078] At 706, the method may include the computing device comparing the metric to a threshold metric, the metric being associated with the hardware component and the metric being based at least in part on the message. The threshold may be based on a configurable KPI provided to the computing device.

[0079] At 708, the method may include the computing device determining, based at least in part on the comparison, a likelihood of a ransomware attack. For example, if the collected metrics exceed one or more thresholds and after analysis for false positives, the computing device may transmit a message that a ransomware attack has been detected. However, if the collected metrics do not exceed any thresholds, the computing device may transmit a message that a ransomware attack has not been detected.

[0080] At 710 , the method may include the computing device transmitting, to the user space repository, a second message including a determination of the likelihood of ransomware.

[0081] As mentioned above, Infrastructure as a Service (IaaS) is a specific type of cloud computing. IaaS can be configured to provide virtualized computing resources over a public network (e.g., the Internet). In the IaaS model, cloud computing providers can host infrastructure components (e.g., servers, storage devices, network nodes (e.g., hardware), deployment software, platform virtualization (e.g., hypervisor layer), etc.). In some cases, IaaS providers can also supply a variety of services to accompany those infrastructure components (example services include accounting software, monitoring software, logging software, load balancing software, and clustering software, etc.). Therefore, since these services can be policy-driven, IaaS users can be able to implement policies to drive load balancing to maintain application availability and performance.

[0082] In some cases, IaaS customers can access resources and services over a wide area network (WAN) such as the Internet, and can use the cloud provider's services to install the remaining elements of the application stack. For example, a user can log in to the IaaS platform to create virtual machines (VMs), install an operating system (OS) on each VM, deploy middleware such as a database, create storage buckets for workloads and backups, and even install enterprise software into the VM. The customer can then use the provider's services to perform a variety of functions, including balancing network traffic, troubleshooting application problems, monitoring performance, managing disaster recovery, etc.

[0083] In most cases, the cloud computing model will require the involvement of a cloud provider. A cloud provider can, but need not, be a third-party service that specializes in providing (e.g., supplying, renting, selling) IaaS. An entity may also choose to deploy a private cloud and become its own provider of infrastructure services.

[0084] In some examples, IaaS deployment is the process of placing a new application or a new version of an application onto a prepared application server, etc. It may also include the process of preparing the server (e.g., installing libraries, daemons, etc.). This is typically managed by the cloud provider below the hypervisor layer (e.g., servers, storage, network hardware, and virtualization). Thus, the customer may be responsible for processing (OS), middleware, and / or application deployment (e.g., on a self-service virtual machine (e.g., which can be started on demand), etc.

[0085] In some examples, IaaS provisioning can refer to obtaining a computer or virtual host for use, and even installing required libraries or services on it. In most cases, deployment does not include provisioning, and provisioning may need to be performed first.

[0086] In some cases, there are two distinct challenges for IaaS provisioning. First, there is the initial challenge of provisioning an initial set of infrastructure before running anything. Second, after everything has been provisioned, there is the challenge of evolving the existing infrastructure (e.g., adding new services, changing services, removing services, etc.). In some cases, both of these challenges can be addressed by enabling the configuration of the infrastructure to be defined declaratively. In other words, the infrastructure (e.g., what components are required and how they interact) can be defined by one or more configuration files. Thus, the overall topology of the infrastructure (e.g., what resources depend on which resources and how each of them works together) can be described declaratively. In some cases, after the topology is defined, workflows can be generated to create and / or manage the different components described in the configuration files.

[0087] In some examples, the infrastructure can have many interconnected elements. For example, there can be one or more virtual private clouds (VPCs) (e.g., a potential on-demand pool of configurable and / or shared computing resources), also referred to as a core network. In some examples, there can also be one or more inbound / outbound traffic group rules and one or more virtual machines (VMs) that are provided to define how inbound and / or outbound traffic for the network will be established. Other infrastructure elements such as load balancers, databases, etc. can also be provided. As more and more infrastructure elements are desired and / or added, the infrastructure can evolve gradually.

[0088] In some cases, continuous deployment techniques can be used to enable deployment of infrastructure code across various virtual computing environments. In addition, the described techniques can enable infrastructure management within these environments. In some examples, a service team can write code that is expected to be deployed to one or more (but typically multiple) different production environments (e.g., across various geographical locations, sometimes even across the world). However, in some examples, the infrastructure on which the code will be deployed must first be established. In some cases, provisioning can be done manually, provisioning tools can be utilized to provision resources, and / or when the infrastructure is provisioned, deployment tools can be utilized to deploy code.

[0089] Figure 8 8 is a block diagram 800 illustrating an example schema of an IaaS architecture according to at least one embodiment. A service operator 802 can be communicatively coupled to a secure host lease 804 that can include a virtual cloud network (VCN) 806 and a secure host subnet 808. In some examples, the service operator 802 can use one or more client computing devices, which can be portable handheld devices (e.g., Cellular phone, computing tablets, personal digital assistants (PDAs), or wearable devices (e.g., Google head mounted display), running software (such as Microsoft Windows ) and / or a variety of mobile operating systems (such as iOS, Windows Phone, Android, BlackBerry 8, Palm OS, etc.), and enable Internet, email, short message service (SMS), or other communication protocols. Alternatively, the client computing device may be a general-purpose personal computer, including, for example, running various versions of Microsoft Apple The client computing device can be a personal computer and / or laptop computer running any of a variety of commercial or a workstation computer running a UNIX-like operating system (including, but not limited to, various GNU / Linux operating systems, such as, for example, Google Chrome OS). Alternatively or in addition, the client computing device may be any other electronic device capable of communicating over a network that can access VCN 806 and / or the Internet, such as a thin client computer, an Internet-enabled gaming system (e.g., with or without a VCN 806 or a server), or a computer that can access the VCN 806 and / or the Internet. gesture input device for a Microsoft Xbox gaming console), and / or a personal messaging device.

[0090] VCN 806 may include a local peer gateway (LPG) 810, which may be communicatively coupled to a secure shell (SSH) VCN 812 via the LPG 810 contained in an SSH VCN 812. SSH VCN 812 may include an SSH subnet 814, and SSH VCN 812 may be communicatively coupled to a control plane VCN 816 via the LPG 810 contained in a control plane VCN 816. Additionally, SSH VCN 812 may be communicatively coupled to a data plane VCN 818 via the LPG 810. Control plane VCN 816 and data plane VCN 818 may be contained in a service lease 819, which may be owned and / or operated by an IaaS provider.

[0091] The control plane VCN 816 may include a control plane demilitarized zone (DMZ) layer 820, which acts as a perimeter network (e.g., a portion of a company network between a company intranet and an external network). DMZ-based servers may have limited responsibilities and help keep breaches contained. In addition, the DMZ layer 820 may include (one or more) load balancer (LB) subnets 822, a control plane application layer 824 that may include (one or more) application subnets 826, and a control plane data layer 828 that may include (one or more) database (DB) subnets 830 (e.g., (one or more) front-end DB subnets and / or (one or more) back-end DB subnets). The LB subnet(s) 822 included in the control plane DMZ layer 820 may be communicatively coupled to the application subnet(s) 826 included in the control plane application layer 824 and the Internet gateway 834 that may be included in the control plane VCN 816, and the application subnet(s) 826 may be communicatively coupled to the DB subnet(s) 830 included in the control plane data layer 828 and the service gateway 836 and the network address translation (NAT) gateway 838. The control plane VCN 816 may include the service gateway 836 and the NAT gateway 838.

[0092] The control plane VCN 816 may include a data plane mirror application layer 840, which may include application subnet(s) 826. The application subnet(s) 826 contained in the data plane mirror application layer 840 may include a virtual network interface controller (VNIC) 842, which may execute a compute instance 844. The compute instance 844 may communicatively couple the application subnet(s) 826 of the data plane mirror application layer 840 to the application subnet(s) 826 that may be contained in the data plane application layer 846.

[0093] The data plane VCN 818 may include a data plane application layer 846, a data plane DMZ layer 848, and a data plane data layer 850. The data plane DMZ layer 848 may include LB subnet(s) 822 that may be communicatively coupled to the application subnet(s) 826 of the data plane application layer 846 and the internet gateway 834 of the data plane VCN 818. The application subnet(s) 826 may be communicatively coupled to the service gateway 836 of the data plane VCN 818 and the NAT gateway 838 of the data plane VCN 818. The data plane data layer 850 may also include DB subnet(s) 830 that may be communicatively coupled to the application subnet(s) 826 of the data plane application layer 846.

[0094] The Internet gateway 834 of the control plane VCN 816 and the data plane VCN 818 may be communicatively coupled to the metadata management service 852, which may be communicatively coupled to the public Internet 854. The public Internet 854 may be communicatively coupled to the NAT gateway 838 of the control plane VCN 816 and the data plane VCN 818. The service gateway 836 of the control plane VCN 816 and the data plane VCN 818 may be communicatively coupled to the cloud service 856.

[0095] In some examples, a service gateway 836 of a control plane VCN 816 or a data plane VCN 818 can make an application programming interface (API) call to a cloud service 856 without traversing the public Internet 854. The API call from the service gateway 836 to the cloud service 856 can be one-way: the service gateway 836 can make the API call to the cloud service 856, and the cloud service 856 can send the requested data to the service gateway 836. However, the cloud service 856 may not initiate the API call to the service gateway 836.

[0096] In some examples, secure host lease 804 can be directly connected to service lease 819, which would otherwise be isolated. Secure host subnet 808 can communicate with SSH subnet 814 through LPG 810, which can enable two-way communication through otherwise isolated systems. Connecting secure host subnet 808 to SSH subnet 814 can give secure host subnet 808 access to other entities within service lease 819.

[0097] The control plane VCN 816 may allow users of the service lease 819 to establish or otherwise provision desired resources. The desired resources provisioned in the control plane VCN 816 may be deployed or otherwise used in the data plane VCN 818. In some examples, the control plane VCN 816 may be isolated from the data plane VCN 818, and the data plane mirror application layer 840 of the control plane VCN 816 may communicate with the data plane application layer 846 of the data plane VCN 818 via a VNIC 842 that may be included in the data plane mirror application layer 840 and the data plane application layer 846.

[0098] In some examples, a user or customer of the system may make a request (e.g., a create, read, update, or delete (CRUD) operation) over the public internet 854, which may communicate the request to the metadata management service 852. The metadata management service 852 may communicate the request to the control plane VCN 816 via the internet gateway 834. The request may be received by the LB subnet(s) 822 contained in the control plane DMZ layer 820. The LB subnet(s) 822 may determine that the request is valid, and in response to this determination, the LB subnet(s) 822 may communicate the request to the application subnet(s) 826 contained in the control plane application layer 824. If the request is validated and a call to the public internet 854 is required, the call to the public internet 854 may be communicated to the NAT gateway 838, which may make the call to the public internet 854. Metadata that may be desired to be stored by the request may be provided in the DB subnet(s) 830.

[0099] In some examples, the data plane mirror application layer 840 may facilitate direct communication between the control plane VCN 816 and the data plane VCN 818. For example, it may be desirable to apply changes, updates, or other appropriate modifications to the configuration to the resources contained in the data plane VCN 818. The control plane VCN 816 may communicate directly with the resources contained in the data plane VCN 818 via the VNIC 842 and may thereby perform changes, updates, or other appropriate modifications to the configuration of the resources contained in the data plane VCN 818.

[0100] In some embodiments, the control plane VCN 816 and the data plane VCN 818 may be included in the service lease 819. In this case, the user or customer of the system may not own or operate the control plane 816 or the data plane VCN 818. Instead, the IaaS provider may own or operate the control plane VCN 816 and the data plane VCN 818, both of which may be included in the service lease 819. This embodiment may enable network isolation that may prevent a user or customer from interacting with other users' or other customers' resources. In addition, this embodiment may allow a user or customer of the system to store a database privately without relying on the public Internet 854, which may not have the desired level of threat prevention.

[0101] In other embodiments, the LB subnet(s) 822 contained in the control plane VCN 816 can be configured to receive signals from the service gateway 836. In this embodiment, the control plane VCN 816 and the data plane VCN 818 can be configured to be called by customers of the IaaS provider without calling the public Internet 854. Customers of the IaaS provider may desire this embodiment because the database(s) used by the customer can be controlled by the IaaS provider and can be stored on a service lease 819 that can be isolated from the public Internet 854.

[0102] Fig. 9 900 is a block diagram illustrating another example model of an IaaS architecture according to at least one embodiment. A service operator 902 (e.g., Figure 8 The service operator 802) can be communicatively coupled to the secure host lease 904 (e.g., Figure 8 secure host lease 804), which may include a virtual cloud network (VCN) 906 (e.g., Figure 8 VCN 806) and secure host subnet 908 (e.g., Figure 8 The VCN 906 may include a local peer gateway (LPG) 910 (e.g., Figure 8 810), which may be communicatively coupled to a secure shell (SSH) VCN 912 via an LPG 810 contained in an SSH VCN 912 (e.g., Figure 8 SSH VCN 912 may include SSH subnet 914 (e.g., Figure 8 SSH subnet 814), and SSH VCN 912 can be communicatively coupled to control plane VCN 916 via LPG 910 contained in control plane VCN 916 (e.g., Figure 8 The control plane VCN 816 of FIG. 814 ). The control plane VCN 916 may be included in a service lease 919 (e.g., Figure 8 service lease 819), and the data plane VCN 918 (e.g., Figure 8 The data plane VCN 818) may be contained in a customer lease 921 which may be owned or operated by a user or customer of the system.

[0103] The control plane VCN 916 may include (one or more) LB subnets 922 (e.g., Figure 8 LB subnet(s) 822) of the control plane DMZ layer 920 (e.g., Figure 8 The control plane DMZ layer 820 may include (one or more) application subnets 926 (e.g., Figure 8 (one or more) application subnets 826) of the control plane application layer 924 (e.g., Figure 8 The control plane application layer 824 of FIG. 1 may include (one or more) database (DB) subnets 930 (e.g., similar to Figure 8 (one or more) DB subnets 830) of the control plane data layer 928 (e.g., Figure 8 The LB subnet(s) 922 contained in the control plane DMZ layer 920 may be communicatively coupled to the application subnet(s) 926 contained in the control plane application layer 924 and the internet gateway 934 (e.g., Figure 8 834), and the application subnet(s) 926 may be communicatively coupled to the DB subnet(s) 930 and service gateway 936 (e.g., Figure 8 service gateway 836) and a network address translation (NAT) gateway 938 (e.g., Figure 8 The control plane VCN 916 may include a service gateway 936 and a NAT gateway 938.

[0104] The control plane VCN 916 may include a data plane mirror application layer 940 (e.g., Figure 8 The data plane image application layer 840 may include (one or more) application subnets 926. The (one or more) application subnets 926 included in the data plane image application layer 940 may include a computing instance 944 (e.g., similar to Figure 8 The compute instance 944 may include a virtual network interface controller (VNIC) 942 (e.g., VNIC 842) of the compute instance 844. The compute instance 944 may facilitate the (one or more) application subnets 926 of the data plane mirror application layer 940 and the application subnets 926 that may be included in the data plane application layer 946 (e.g., VNIC 842) via the VNIC 942 included in the data plane mirror application layer 940 and the VNIC 942 included in the data plane application layer 946. Figure 8 Communication between (one or more) application subnets 926 in the data plane application layer 846).

[0105] The Internet gateway 934 included in the control plane VCN 916 can be communicatively coupled to the metadata management service 952 (e.g., Figure 8 , which can be communicatively coupled to a public Internet 954 (e.g., Figure 8The public Internet 954 can be communicatively coupled to a NAT gateway 938 included in the control plane VCN 916. The service gateway 936 included in the control plane VCN 916 can be communicatively coupled to a cloud service 956 (e.g., Figure 8 Cloud service 856).

[0106] In some examples, the data plane VCN 918 may be contained in a customer lease 921. In this case, the IaaS provider may provide a control plane VCN 916 for each customer, and the IaaS provider may establish a unique compute instance 944 contained in a service lease 919 for each customer. Each compute instance 944 may allow communication between the control plane VCN 916 contained in the service lease 919 and the data plane VCN 918 contained in the customer lease 921. The compute instance 944 may allow resources provisioned in the control plane VCN 916 contained in the service lease 919 to be deployed or otherwise used in the data plane VCN 918 contained in the customer lease 921.

[0107] In other examples, a customer of the IaaS provider may own a database that exists in the customer lease 921. In this example, the control plane VCN 916 may include a data plane mirror application layer 940 that may include (one or more) application subnets 926. The data plane mirror application layer 940 may reside in the data plane VCN 918, but the data plane mirror application layer 940 may not exist in the data plane VCN 918. That is, the data plane mirror application layer 940 may have access to the customer lease 921, but the data plane mirror application layer 940 may not exist in the data plane VCN 918 or be owned or operated by the customer of the IaaS provider. The data plane mirror application layer 940 may be configured to make calls to the data plane VCN 918, but may not be configured to make calls to any entity contained in the control plane VCN 916. A customer may desire to deploy or otherwise use resources provisioned in control plane VCN 916 in data plane VCN 918, and data plane mirror application layer 940 may facilitate the customer's desired deployment or other use of the resources.

[0108] In some embodiments, a customer of an IaaS provider may apply filters to the data plane VCN 918. In this embodiment, the customer may determine what the data plane VCN 918 may access, and the customer may restrict access to the public Internet 954 from the data plane VCN 918. The IaaS provider may not apply filters or otherwise control access to any external network or database by the data plane VCN 918. The customer applies filters and controls to the data plane VCN 918 included in the customer lease 921, which can help isolate the data plane VCN 918 from other customers and from the public Internet 954.

[0109] In some embodiments, cloud services 956 may be called by service gateway 936 to access services that may not exist on the public Internet 954, on control plane VCN 916, or on data plane VCN 918. The connection between cloud services 956 and control plane VCN 916 or data plane VCN 918 may not be active or persistent. Cloud services 956 may exist on different networks owned or operated by IaaS providers. Cloud services 956 may be configured to receive calls from service gateway 936 and may be configured not to receive calls from the public Internet 954. Some cloud services 956 may be isolated from other cloud services 956, and control plane VCN 916 may be isolated from cloud services 956 that may not be in the same region as control plane VCN 916. For example, control plane VCN 916 may be located in "Region 1", while cloud service "Deployment 8" may be located in Region 1 and "Region 2". If the call to deployment 8 is made by a service gateway 936 contained in a control plane VCN 916 located in region 1, the call may be transmitted to deployment 8 in region 1. In this example, control plane VCN 916 or deployment 8 in region 1 may not be communicatively coupled to deployment 8 in region 2, or may otherwise be in communication with deployment 8 in region 2.

[0110] Fig.10 1 is a block diagram 1000 illustrating another example model of an IaaS architecture according to at least one embodiment. A service operator 1002 (e.g., Figure 8 The service operator 802 of FIG. 1002 may be communicatively coupled to the secure host lease 1004 (eg, Figure 8 The secure host lease 1004 may include a virtual cloud network (VCN) 1006 (e.g., Figure 8 VCN 806) and secure host subnet 1008 (e.g., Figure 8 VCN 1006 may include LPG 1010 (e.g., Figure 8810), which may be communicatively coupled to the SSH VCN 1012 via the LPG 1010 contained in the SSH VCN 1012 (e.g., Figure 8 SSH VCN 1012 may include SSH subnet 1014 (e.g., Figure 8 SSH subnet 814 of the control plane VCN 1016), and SSH VCN 1012 can be communicatively coupled to control plane VCN 1016 via LPG 1010 contained in control plane VCN 1016 (e.g., Figure 8 The control plane VCN 816 of the embodiment of the present invention is communicatively coupled to the data plane VCN 1018 (e.g., the control plane VCN 816 of the embodiment of the present invention) and is communicatively coupled to the data plane VCN 1018 via the LPG 1010 contained in the data plane VCN 1018 (e.g., Figure 8 The control plane VCN 1016 and the data plane VCN 1018 may be included in a service lease 1019 (e.g., Figure 8 Service lease 819).

[0111] The control plane VCN 1016 may include a load balancer (LB) subnet 1022 (e.g., Figure 8 LB subnet(s) 822) of the control plane DMZ layer 1020 (e.g., Figure 8 The control plane DMZ layer 820 may include (one or more) application subnets 1026 (e.g., similar to Figure 8 (one or more) application subnets 826) of the control plane application layer 1024 (e.g., Figure 8 The control plane application layer 824 of the embodiment may include a control plane data layer 1028 of (one or more) DB subnets 1030 (e.g., Figure 8 8). The LB subnet(s) 1022 contained in the control plane DMZ layer 1020 may be communicatively coupled to the application subnet(s) 1026 contained in the control plane application layer 1024 and to the internet gateway 1034 (e.g., Figure 8 834), and the application subnet(s) 1026 may be communicatively coupled to the DB subnet(s) 1030 contained in the control plane data layer 1028 and to the service gateway 1036 (e.g., Figure 8 ) and a network address translation (NAT) gateway 1038 (e.g., Figure 8 The control plane VCN 1016 may include a service gateway 1036 and a NAT gateway 1038.

[0112] The data plane VCN 1018 may include a data plane application layer 1046 (e.g., Figure 8 Data plane application layer 846), data plane DMZ layer 1048 (e.g., Figure 8 Data plane DMZ layer 848), and data plane data layer 1050 (e.g., Figure 8 The data plane DMZ layer 1048 may include (one or more) LB subnets 1022, which may be communicatively coupled to the (one or more) trusted application subnets 1060 and (one or more) untrusted application subnets 1062 of the data plane application layer 1046 and the Internet gateway 1034 included in the data plane VCN 1018. The (one or more) trusted application subnets 1060 may be communicatively coupled to the service gateway 1036 included in the data plane VCN 1018, the NAT gateway 1038 included in the data plane VCN 1018, and the (one or more) DB subnets 1030 included in the data plane data layer 1050. The (one or more) untrusted application subnets 1062 may be communicatively coupled to the service gateway 1036 included in the data plane VCN 1018 and the (one or more) DB subnets 1030 included in the data plane data layer 1050. Data plane data layer 1050 may include DB subnet(s) 1030 , which may be communicatively coupled to a service gateway 1036 included in data plane VCN 1018 .

[0113] Trusted application subnet(s) 1062 may include one or more primary VNICs 1064(1)-(N) that may be communicatively coupled to tenant virtual machines (VMs) 1066(1)-(N). Each tenant VM 1066(1)-(N) may be communicatively coupled to a respective application subnet 1067(1)-(N) that may be contained in a respective container egress VCN 1068(1)-(N), which may be contained in a respective customer tenancy 1070(1)-(N). Respective secondary VNICs 1072(1)-(N) may facilitate communications between the untrusted application subnet(s) 1062 contained in the data plane VCN 1018 and the application subnets contained in the container egress VCNs 1068(1)-(N). Each container egress VCN 1068(1)-(N) may include a NAT gateway 1038 that may be communicatively coupled to the public Internet 1054 (e.g., Figure 8 of the public Internet 854).

[0114] The Internet gateways 1034 included in the control plane VCN 1016 and included in the data plane VCN 1018 can be communicatively coupled to the metadata management service 1052 (e.g., Figure 8 The metadata management service 1052 may be communicatively coupled to the public Internet 1054. The public Internet 1054 may be communicatively coupled to the NAT gateway 1038 included in the control plane VCN 1016 and included in the data plane VCN 1018. The service gateway 1036 included in the control plane VCN 1016 and included in the data plane VCN 1018 may be communicatively coupled to the cloud service 1056.

[0115] In some embodiments, data plane VCN 1018 can be integrated with customer lease 1070. In some cases, such integration can be useful or desirable for customers of the IaaS provider, such as where support may be desired when executing code. A customer may provide code to run that may be destructive, may communicate with other customer resources, or may otherwise cause adverse effects. In response to this, the IaaS provider can determine whether to run the code given to the IaaS provider by the customer.

[0116] In some examples, a customer of an IaaS provider may grant temporary network access to the IaaS provider and request functionality to be attached to the data plane layer application layer 1046. Code running the functionality may be executed in a VM 1066(1)-(N), and the code may not be configured to run anywhere else on the data plane VCN 1018. Each VM 1066(1)-(N) may be connected to one customer tenancy 1070. Respective containers 1071(1)-(N) contained in a VM 1066(1)-(N) may be configured to run the code. In this case, there can be double isolation (e.g., containers 1071(1)-(N) running code, where containers 1071(1)-(N) can be contained at least in VMs 1066(1)-(N) contained in non-trusted application subnet(s) 1062), which can help prevent incorrect or otherwise undesirable code from damaging the IaaS provider's network or damaging the network of a different customer. Containers 1071(1)-(N) can be communicatively coupled to customer lease 1070 and can be configured to transmit or receive data from customer lease 1070. Containers 1071(1)-(N) can not be configured to transmit or receive data from any other entity in data plane VCN 1018. After running the code is complete, the IaaS provider can terminate or otherwise dispose of containers 1071(1)-(N).

[0117] In some embodiments, the trusted application subnet(s) 1060 may run code that may be owned or operated by the IaaS provider. In this embodiment, the trusted application subnet(s) 1060 may be communicatively coupled to the DB subnet(s) 1030 and configured to perform CRUD operations in the DB subnet(s) 1030. The untrusted application subnet(s) 1062 may be communicatively coupled to the DB subnet(s) 1030, but in this embodiment, the untrusted application subnet(s) may be configured to perform read operations in the DB subnet(s) 1030. The containers 1071(1)-(N) that may be included in each customer's VM 1066(1)-(N) and that may run code from the customer may not be communicatively coupled to the DB subnet(s) 1030.

[0118] In other embodiments, the control plane VCN 1016 and the data plane VCN 1018 may not be directly communicatively coupled. In this embodiment, there may be no direct communication between the control plane VCN 1016 and the data plane VCN 1018. However, communication may occur indirectly through at least one method. The LPG 1010 may be established by an IaaS provider, which may facilitate communication between the control plane VCN 1016 and the data plane VCN 1018. In another example, the control plane VCN 1016 or the data plane VCN 1018 may make a call to the cloud service 1056 via the service gateway 1036. For example, the call from the control plane VCN 1016 to the cloud service 1056 may include a request for a service that may communicate with the data plane VCN 1018.

[0119] Fig.11 1 is a block diagram 1100 illustrating another example model of an IaaS architecture according to at least one embodiment. A service operator 1102 (e.g., Figure 8 The service operator 802) can be communicatively coupled to the secure host lease 1104 (e.g., Figure 8 The secure host lease 1104 may include a virtual cloud network (VCN) 1106 (e.g., Figure 8 VCN 806) and secure host subnet 1108 (e.g., Figure 8 VCN 1106 may include LPG 1110 (e.g., Figure 8 810), which may be communicatively coupled to the SSH VCN 1112 via the LPG 1110 contained in the SSH VCN 1112 (e.g., Figure 8 SSH VCN 1112 may include SSH subnet 1114 (e.g., Figure 8 SSH subnet 814 of the control plane VCN 1116), and SSH VCN 1112 can be communicatively coupled to control plane VCN 1116 via LPG 1110 contained in control plane VCN 1116 (e.g., Figure 8 The control plane VCN 816 of the embodiment of the present invention is communicatively coupled to the data plane VCN 1118 (e.g., the control plane VCN 816 of the embodiment of the present invention) and is communicatively coupled to the data plane VCN 1118 via the LPG 1110 contained in the data plane VCN 1118 (e.g., Figure 8 The control plane VCN 1116 and the data plane VCN 1118 may be included in a service lease 1119 (e.g., Figure 8 Service lease 819).

[0120] The control plane VCN 1116 may include (one or more) LB subnets 1122 (e.g., Figure 8 (one or more) LB subnets 822))) of the control plane DMZ layer 1120 (e.g., Figure 8 The control plane DMZ layer 820 may include (one or more) application subnets 1126 (e.g., Figure 8 (one or more) application subnets 826) of the control plane application layer 1124 (e.g., Figure 8 control plane application layer 824), may include (one or more) DB subnets 1130 (e.g., Fig.10 (one or more) DB subnets 1030) of the control plane data layer 1128 (e.g., Figure 8 1128). The LB subnet(s) 1122 contained in the control plane DMZ layer 1120 may be communicatively coupled to the application subnet(s) 1126 contained in the control plane application layer 1124 and the internet gateway 1134 (e.g., Figure 8 834), and the application subnet(s) 1126 may be communicatively coupled to the DB subnet(s) 1130 and the service gateway 1136 (e.g., Figure 8 ) and a network address translation (NAT) gateway 1138 (e.g., Figure 8 NAT gateway 838). The control plane VCN 1116 may include a service gateway 1136 and a NAT gateway 1138.

[0121] Data plane VCN 1118 may include a data plane application layer 1146 (e.g., Figure 8 Data plane application layer 846), data plane DMZ layer 1148 (e.g., Figure 8 Data plane DMZ layer 848) and data plane data layer 1150 (e.g., Figure 8 The data plane DMZ layer 1148 may include (one or more) LB subnets 1122, which may be communicatively coupled to (one or more) trusted application subnets 1160 (e.g., Fig.10 (one or more) trusted application subnets 1060) and (one or more) untrusted application subnets 1162 (e.g., Fig.10The trusted application subnet(s) 1160 may be communicatively coupled to the service gateway 1136 contained in the data plane VCN 1118, the NAT gateway 1138 contained in the data plane VCN 1118, and the DB subnet(s) 1130 contained in the data plane data layer 1150. The untrusted application subnet(s) 1162 may be communicatively coupled to the service gateway 1136 contained in the data plane VCN 1118 and the DB subnet(s) 1130 contained in the data plane data layer 1150. The data plane data layer 1150 may include the DB subnet(s) 1130 that may be communicatively coupled to the service gateway 1136 contained in the data plane VCN 1118.

[0122] The non-trusted application subnet(s) 1162 may include primary VNICs 1164(1)-(N) that may be communicatively coupled to tenant virtual machines (VMs) 1166(1)-(N) residing within the non-trusted application subnet(s) 1162. Each tenant VM 1166(1)-(N) may run code in a respective container 1167(1)-(N) and may be communicatively coupled to an application subnet 1126 that may be contained in a data plane application layer 1146 that may be contained in a container egress VCN 1168. Corresponding secondary VNICs 1172(1)-(N) may facilitate communications between the non-trusted application subnet(s) 1162 contained in the data plane VCN 1118 and the application subnets contained in the container egress VCN 1168. The container egress VCN may include a NAT gateway 1138 that may be communicatively coupled to the public Internet 1154 (e.g., Figure 8 of the public Internet 854).

[0123] The Internet gateway 1134 included in the control plane VCN 1116 and included in the data plane VCN 1118 can be communicatively coupled to the metadata management service 1152 (e.g., Figure 8The metadata management service 1152 may be communicatively coupled to the public Internet 1154. The public Internet 1154 may be communicatively coupled to the NAT gateway 1138 included in the control plane VCN 1116 and included in the data plane VCN 1118. The service gateway 1136 included in the control plane VCN 1116 and included in the data plane VCN 1118 may be communicatively coupled to the cloud service 1156.

[0124] In some examples, the Fig.11 The block diagram 1100 of the architectural diagram may be considered to be composed of Fig.10 1000 , and may be desired by a customer of the IaaS provider if the IaaS provider cannot communicate directly with the customer (e.g., a disconnected region). The corresponding container 1167(1)-(N) contained in each customer's VM 1166(1)-(N) can be accessed by the customer in real time. The container 1167(1)-(N) can be configured to make calls to the corresponding secondary VNIC 1172(1)-(N) contained in the (one or more) application subnets 1126 of the data plane application layer 1146, which can be contained in the container egress VCN 1168. The secondary VNIC 1172(1)-(N) can transmit the call to the NAT gateway 1138, which can transmit the call to the public Internet 1154. In this example, containers 1167(1)-(N), which may be accessed by customers in real time, may be isolated from control plane VCN 1116 and may be isolated from other entities contained in data plane VCN 1118. Containers 1167(1)-(N) may also be isolated from resources from other customers.

[0125] In other examples, a customer may use containers 1167(1)-(N) to call cloud service 1156. In this example, a customer may run code in container 1167(1)-(N) that requests a service from cloud service 1156. Container 1167(1)-(N) may transmit this request to secondary VNIC 1172(1)-(N), which may transmit the request to a NAT gateway, which may transmit the request to public Internet 1154. Public Internet 1154 may transmit the request to LB subnet(s) 1122 contained in control plane VCN 1116 via Internet gateway 1134. In response to determining that the request is valid, LB subnet(s) may transmit the request to application subnet(s) 1126, which may transmit the request to cloud service 1156 via service gateway 1136.

[0126] It should be understood that the IaaS architectures 800, 900, 1000, 1100 depicted in the figures may have other components in addition to those depicted. In addition, the embodiments shown in the figures are only some examples of cloud infrastructure systems that can be combined with embodiments of the present disclosure. In some other embodiments, the IaaS system may have more or fewer components than shown in the figures, may combine two or more components, or may have a different configuration or arrangement of components.

[0127] In certain embodiments, the IaaS system described herein may include a set of application, middleware, and database service offerings delivered to customers in a self-service, subscription-based, elastically scalable, reliable, highly available, and secure manner. An example of such an IaaS system is Oracle Cloud Infrastructure (OCI) provided by the assignee.

[0128] Fig.12 An example computer system 1200 is illustrated in which various embodiments may be implemented. System 1200 may be used to implement any of the computer systems described above. As shown, computer system 1200 includes a processing unit 1204 that communicates with a plurality of peripheral subsystems via a bus subsystem 1202. These peripheral subsystems may include a processing acceleration unit 1206, an I / O subsystem 1208, a storage subsystem 1218, and a communication subsystem 1224. Storage subsystem 1218 includes a tangible computer-readable storage medium 1222 and a system memory 1210.

[0129] The bus subsystem 1202 provides a mechanism for allowing the various components and subsystems of the computer system 1200 to communicate with each other as expected. Although the bus subsystem 1202 is schematically shown as a single bus, an alternative embodiment of the bus subsystem can utilize multiple buses. The bus subsystem 1202 can be any of several types of bus structures, including a memory bus or a memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. For example, such an architecture can include an industry standard architecture (ISA) bus, a microchannel architecture (MCA) bus, an enhanced ISA (EISA) bus, a video electronics standard association (VESA) local bus, and a peripheral component interconnect (PCI) bus that can be implemented as a mezzanine bus manufactured according to the IEEE P1386.1 standard.

[0130] The processing unit 1204, which may be implemented as one or more integrated circuits (e.g., conventional microprocessors or microcontrollers), controls the operation of the computer system 1200. One or more processors may be included in the processing unit 1204. These processors may include single-core or multi-core processors. In some embodiments, the processing unit 1204 may be implemented as one or more independent processing units 1232 and / or 1234, each of which includes a single-core or multi-core processor. In other embodiments, the processing unit 1204 may also be implemented as a quad-core processing unit formed by integrating two dual-core processors into a single chip.

[0131] In various embodiments, the processing unit 2004 can execute a variety of programs in response to program code and can maintain multiple concurrently executed programs or processes. At any given time, some or all of the program code to be executed may reside in (one or more) processors 1204 and / or storage subsystem 1218. Through appropriate programming, (one or more) processors 1204 can provide the various functions described above. In addition, the computer system 1200 may include a processing acceleration unit 1206, which may include a digital signal processor (DSP), a special processor and / or the like.

[0132] I / O subsystem 1208 may include user interface input devices and user interface output devices. User interface input devices may include keyboards, pointing devices such as a mouse or trackball, touch pads or touch screens incorporated into a display, scroll wheels, click wheels, dials, buttons, switches, keypads, audio input devices with voice command recognition systems, microphones, and other types of input devices. User interface input devices may include, for example, motion sensing and / or gesture recognition devices, such as those that enable a user to control input devices through a natural user interface using gestures and verbal commands (such as Microsoft 360 game controller) and interact with it Motion sensors. User interface input devices may also include eye gesture recognition devices such as Google Blink detector, which detects eye activity from the user (e.g., "blinking" when taking a picture and / or making a menu selection) and converts the eye gesture to an input device (e.g., Google ) input. In addition, the user interface input device may include a device that enables a user to communicate with a speech recognition system (e.g., Navigator) interactive voice recognition sensing device.

[0133] The user interface input device may also include, but is not limited to, a three-dimensional (3D) mouse, a joystick or pointing rod, a game controller and a graphics tablet, and audio / video equipment, such as a speaker, a digital camera, a digital video camera, a portable media player, a webcam, an image scanner, a fingerprint scanner, a barcode reader 3D scanner, a 3D printer, a laser rangefinder and an eye tracking device. In addition, the user interface input device may include, for example, a medical imaging input device, such as a computer tomography, a magnetic resonance imaging, a positron emission tomography, a medical ultrasound device. The user interface input device may also include, for example, an audio input device, such as a MIDI keyboard, a digital musical instrument, etc.

[0134] The user interface output device may include a display subsystem, indicator lights, or non-visual displays such as audio output devices, etc. The display subsystem may be a cathode ray tube (CRT), a flat panel device such as a liquid crystal display (LCD) or plasma display, a projection device, a touch screen, etc. In general, the use of the term "output device" is intended to include all possible types of devices and mechanisms for outputting information from the computer system 1200 to a user or other computer. For example, the user interface output device may include, but is not limited to, a variety of display devices that visually convey text, graphics, and audio / video information, such as monitors, printers, speakers, headphones, car navigation systems, plotters, voice output devices, and modems.

[0135] Computer system 1200 may include a storage subsystem 1218, which includes software elements, as shown currently located within system memory 1210. System memory 1210 may store program instructions that may be loaded and executed on processing unit 1204, as well as data generated during execution of these programs.

[0136] Depending on the configuration and type of computer system 1200, system memory 1210 may be volatile (such as random access memory (RAM)) and / or non-volatile (such as read-only memory (ROM), flash memory, etc.). RAM typically contains data and / or program services that are immediately accessible to and / or currently being operated and executed by processing unit 1204. In some implementations, system memory 1210 may include multiple different types of memory, such as static random access memory (SRAM) or dynamic random access memory (DRAM). In some implementations, a basic input / output system (BIOS), which contains basic routines that help transfer information between elements within computer system 1200 (such as during startup), may typically be stored in ROM. By way of example and not limitation, system 1210 also illustrates application programs 1212 (which may include client applications, web browsers, middle-tier applications, relational database management systems (RDBMS), etc.), program data 1214, and an operating system 1216. By way of example, operating system 1216 may include various versions of Microsoft Apple and / or Linux operating systems various commercial or UNIX-like operating systems (including but not limited to various GNU / Linux operating systems, Google OS, etc.) and / or mobile operating systems such as iOS, Phone, OS, OS and OS operating system.

[0137] The storage subsystem 1218 may also provide a tangible computer-readable storage medium for storing the underlying programming and data structures that provide the functionality of some embodiments. When executed by a processor, the software (programs, code services, instructions) that provide the functionality described above may be stored in the storage subsystem 1218. These software services or instructions may be executed by the processing unit 1204. The storage subsystem 1218 may also provide a repository for storing data used in accordance with the present disclosure.

[0138] The storage subsystem 1200 may also include a computer-readable storage media reader 1220 that may also be connected to a computer-readable storage medium 1222. Collectively and optionally, in combination with the system memory 1210, the computer-readable storage medium 1222 may comprehensively represent remote, local, fixed, and / or removable storage devices plus storage media for temporarily and / or permanently containing, storing, transferring, and retrieving computer-readable information.

[0139] The computer-readable storage medium 1222 containing the code or portions of the code may also include any suitable media known or used in the art, including storage media and communication media, such as, but not limited to, volatile and non-volatile, removable and non-removable media for storage and / or transmission of information implemented in any method or technology. This may include tangible computer-readable storage media, such as RAM, ROM, electronically erasable programmable ROM (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical storage, cassettes, magnetic tape, disk storage or other magnetic storage devices, or other tangible computer-readable storage media. This may also include non-tangible computer-readable media, such as data signals, data transmissions, or any other media that can be used to transmit the desired information and can be accessed by the computer system 1200.

[0140] By way of example, computer readable storage media 1222 may include a hard disk drive that reads from or writes to non-removable nonvolatile magnetic media, a magnetic disk drive that reads from or writes to removable nonvolatile magnetic disks, and a magnetic disk drive that reads from or writes to removable nonvolatile optical disks (such as CD ROMs, DVDs, and Computer readable storage media 1222 may include, but is not limited to, Drive, flash memory card, universal serial bus (USB) flash memory drive, secure digital (SD) card, DVD disk, digital video tape, etc. The computer readable storage medium 1222 may also include a solid state drive (SSD) based on non-volatile memory (such as a flash memory-based SSD, an enterprise flash drive, a solid-state ROM, etc.), an SSD based on volatile memory (such as a solid-state RAM, dynamic RAM, static RAM, DRAM-based SSD), a magnetoresistive RAM (MRAM) SSD, and a hybrid SSD using a combination of DRAM and a flash memory-based SSD. The disk drive and its associated computer readable media can provide non-volatile storage of computer readable instructions, data structures, program services, and other data for the computer system 1200.

[0141] The communication subsystem 1224 provides an interface to other computer systems and networks. The communication subsystem 1224 serves as an interface for receiving data from other systems from the computer system 1200 and sending data to other systems. For example, the communication subsystem 1224 can enable the computer system 1200 to be connected to one or more devices via the Internet. In some embodiments, the communication subsystem 2024 may include a radio frequency (RF) transceiver component, a global positioning system (GPS) receiver component and / or other components for accessing a wireless voice and / or data network (e.g., using cellular phone technology, advanced data network technology, such as 3G, 4G or EDGE (Enhanced Data Rate Global Evolution), WiFi (IEEE 802.11 series standards, or other mobile communication technologies, or any combination thereof). In some embodiments, in addition to or in place of a wireless interface, the communication subsystem 1224 may provide wired network connectivity (e.g., Ethernet).

[0142] In some embodiments, the communication subsystem 1224 may also receive incoming communications in the form of structured and / or unstructured data feeds 1226 , event streams 1228 , event updates 1230 , and the like on behalf of one or more users who may use the computer system 1200 .

[0143] For example, the communication subsystem 1224 may be configured to receive data feeds 2026 in real time from users of social networks and / or other communication services, such as feed, Updates, web feeds such as Rich Site Summary (RSS) feeds, and / or real-time updates from one or more third-party information sources.

[0144] In addition, the communication subsystem 1224 can also be configured to receive data in the form of a continuous data stream, which can include an event stream 1228 of real-time events and / or event updates 1230, which can be continuous or unbounded in nature without a clear end. Examples of applications that generate continuous data can include, for example, sensor data applications, financial stocks, network performance measurement tools (e.g., network monitoring and traffic management applications), clickstream analysis tools, automobile traffic monitoring, etc.

[0145] The communication subsystem 1224 may also be configured to output structured and / or unstructured data feeds 1226 , event streams 1228 , event updates 1230 , etc. to one or more databases that may be in computer communication with one or more streaming data source computers coupled to the computer system 1200 .

[0146] Computer system 1200 may be one of various types, including a handheld portable device (e.g., Cellular phone, computing tablets, PDAs), wearable devices (e.g., Google head mounted displays), PCs, workstations, mainframes, kiosks, server racks, or any other data processing system.

[0147] Due to the ever-changing nature of computers and networks, the description of the computer system 1200 depicted in the figure is intended only as a specific example. Many other configurations with more or less components than the system depicted in the figure are possible. For example, customized hardware may also be used and / or specific elements may be implemented in hardware, firmware, software (including applets) or in combination. In addition, connections with other computing devices (such as network input / output devices) may be adopted. Based on the disclosure and teachings provided herein, those of ordinary skill in the art will appreciate other ways and / or methods for implementing various embodiments.

[0148] The embodiments may be implemented by using a computer program product comprising a computer program / instructions which, when executed by a processor, cause the processor to perform any of the methods described in the present disclosure.

[0149] Although specific embodiments have been described, various modifications, variations, alternative constructions, and equivalents are also included within the scope of the present disclosure. Embodiments are not limited to operations within certain specific data processing environments, but can be freely operated within multiple data processing environments. In addition, although the embodiments have been described using a specific series of transactions and steps, it should be apparent to those skilled in the art that the scope of the present disclosure is not limited to the described series of transactions and steps. The various features and aspects of the above-described embodiments may be used alone or in combination.

[0150] In addition, although the embodiments have been described using a specific combination of hardware and software, it should be appreciated that other combinations of hardware and software are also within the scope of the present disclosure. The embodiments may be implemented only in hardware, or only in software, or using a combination thereof. The various processes described herein may be implemented in any combination on the same processor or on different processors. Therefore, where a component or module is described as being configured to perform certain operations, such a configuration may be implemented, for example, by designing an electronic circuit to perform the operation, by programming a programmable electronic circuit (such as a microprocessor) to perform the operation, or any combination thereof. The process may communicate using a variety of techniques including, but not limited to, conventional techniques for inter-process communication, and different pairs of processes may use different techniques, or the same pair of processes may use different techniques at different times.

[0151] The specification and drawings are therefore to be regarded in an illustrative rather than a restrictive sense. However, it will be apparent that additions, subtractions, deletions and other modifications and alterations may be made thereto without departing from the broader spirit and scope as set forth in the claims. Therefore, although specific disclosed embodiments have been described, these are not intended to be limiting. Various modifications and equivalents are within the scope of the appended claims.

[0152] The use of the terms "one" and "an" and "the" and similar referents in the context of describing the disclosed embodiments (particularly in the context of the appended claims) should be interpreted as covering both the singular and the plural, unless otherwise specified herein or clearly contradictory to the context. Unless otherwise specified, the terms "include", "have", "contain" and "include" should be interpreted as open terms (i.e., meaning "including, but not limited to"). The term "connected to" should be interpreted as being partially or completely included, attached to or combined together, even if something intervenes. Unless otherwise specified herein, the enumeration of numerical ranges herein is intended only to be used as a shorthand method of expression for referring to each separate value falling within the range individually, and each separate value is incorporated into the specification as if it is separately listed herein. Unless otherwise specified herein or clearly contradictory to the context, all methods described herein can be performed in any suitable order. Unless otherwise required, the use of any and all examples or exemplary language (e.g., "such as") provided herein is intended only to better illustrate the embodiments and does not limit the scope of the present disclosure. No language in the specification should be construed as indicating any non-claimed element as essential to the practice of the disclosure.

[0153] Unless expressly stated otherwise, disjunctive language, such as the phrase "at least one of X, Y, or Z," is intended to be understood within the context as generally used to indicate that an item, term, etc., can be X, Y, or Z, or any combination thereof (e.g., X, Y, and / or Z). Thus, such disjunctive language is generally not intended to, and should not, imply that certain embodiments require that at least one of X, at least one of Y, or at least one of Z each be present.

[0154] Preferred embodiments of the present disclosure are described herein, including known best modes for carrying out the present disclosure. After reading the foregoing description, the variations of those preferred embodiments may become clear to those of ordinary skill in the art. Those of ordinary skill should be able to appropriately adopt such variations, and the present disclosure may be put into practice except as specifically described herein. Therefore, the present disclosure includes all modifications and equivalents of the subject matter listed in the appended claims as permitted by applicable law. In addition, unless otherwise specified herein, any combination of the above-mentioned elements in all possible variations thereof is included in the present disclosure.

[0155] All references, including publications, patent applications, and patents, cited herein are hereby incorporated by reference to the same extent as if each reference were individually and specifically indicated to be incorporated by reference in its entirety and were set forth herein.

[0156] In the foregoing description, aspects of the present disclosure are described with reference to specific embodiments of the present disclosure, but those skilled in the art will recognize that the present disclosure is not limited thereto. The various features and aspects disclosed above may be used alone or in combination. In addition, embodiments may be utilized in any number of environments and applications beyond those described herein without departing from the broader spirit and scope of the present description. Therefore, the description and drawings are considered to be illustrative rather than restrictive.

Claims

1. A computer-implemented method comprising: The operating system is configured by the cloud infrastructure nodes to collect metrics related to the hardware components; receiving, by the cloud infrastructure node, a first message from a user space repository to validate an instruction detected in a cache, the instruction being associated with the hardware component; comparing, by the cloud infrastructure node, the metric to a threshold metric, the metric being associated with the hardware component and being based at least in part on the first message; determining, by the cloud infrastructure node, a likelihood of a ransomware attack based at least in part on the comparing; as well as A second message including the determination of a likelihood of ransomware is transmitted by the cloud infrastructure node to the user space repository.

2. The computer-implemented method of claim 1, wherein the first message is received based at least in part on detection of a modification of a mapping of a cache location to a memory location by the user space library.

3. The computer-implemented method of claim 1 or 2, wherein the cache comprises an instruction cache and the instructions comprise assembly instructions.

4. The computer-implemented method of any one of claims 1 to 3, wherein the method further comprises: detecting instruction classes of instructions stored in the cache; determining a frequency of instances of the instruction in the cache; assigning a weight to the instruction based at least in part on the class; as well as A likelihood of a ransomware attack is determined based at least in part on the weight.

5. The computer-implemented method of any one of claims 1 to 4, wherein the method further comprises: generating a first cryptographic degree map including a first row of encryption-related data associated with the cache, and generating a second cryptographic degree map including a second row of encryption-related data associated with the cache, wherein the first row is associated with the instruction; performing a mathematical exclusive-OR operation on the first row and the second row to derive a change value; comparing the derived change value to a threshold change value; as well as A determination is made based on the comparison whether the likelihood of a ransomware attack is a false positive.

6. The computer-implemented method of any one of claims 1-5, wherein the method further comprises registering a callback function, and wherein the first message is based at least in part on the callback function.

7. The computer-implemented method of any of claims 1-6, wherein the method further comprises receiving a notification that an instance has been resurfaced based at least in part on the determination of a likelihood of a ransomware attack.

8. A cloud infrastructure node, comprising: processor; as well as A computer readable medium comprising instructions which, when executed by the processor, cause the processor to: Configure the operating system to collect hardware-related metrics; receiving a first message from a user space library to validate an instruction detected in a cache, the instruction being associated with the hardware; comparing the metric to a threshold metric, the metric being associated with the hardware component and being based at least in part on the first message; determining a likelihood of a ransomware attack based at least in part on the comparing; as well as A second message including the determination of a likelihood of ransomware is transmitted to the user space repository.

9. The cloud infrastructure node of claim 8, wherein the first message is received based at least in part on detection of a modification of a mapping of a cache location to a memory location by the user space library.

10. A cloud infrastructure node according to claim 8 or 9, wherein the cache comprises an instruction cache and the instructions comprise assembly instructions.

11. The cloud infrastructure node according to any one of claims 8 to 10, wherein the instructions further cause the processor to: detecting instruction classes of instructions stored in the cache; determining a frequency of instances of the instruction in the cache; assigning a weight to the instruction based at least in part on the class; and A likelihood of a ransomware attack is determined based at least in part on the weight.

12. The cloud infrastructure node according to any one of claims 8 to 11, wherein the instructions further cause the processor to: generating a first cryptographic degree map including a first row of encryption-related data associated with the cache, and generating a second cryptographic degree map including a second row of encryption-related data associated with the cache, wherein the first row is associated with the instruction; performing a mathematical exclusive-OR operation on the first row and the second row to derive a change value; comparing the derived change value to a threshold change value; as well as A determination is made based on the comparison whether the likelihood of a ransomware attack is a false positive.

13. The cloud infrastructure node of any one of claims 8-12, wherein the instructions further cause the processor to register a callback function, and wherein the first message is based at least in part on the callback function.

14. The cloud infrastructure node of any of claims 8-13, wherein the instructions further cause the processor to receive a notification that an instance has been resurfaced based at least in part on the determination of a likelihood of a ransomware attack.

15. A non-transitory computer readable medium comprising a sequence of instructions stored thereon, which, when executed by a processor of a cloud infrastructure node, causes the processor to perform operations comprising: Configure the operating system to collect metrics related to hardware components; receiving a first message from a user space library to validate an instruction detected in a cache, the instruction being associated with the hardware component; comparing the metric to a threshold metric, the metric being associated with the hardware component and being based at least in part on the first message; determining a likelihood of a ransomware attack based at least in part on the comparing; as well as A second message including the determination of a likelihood of ransomware is transmitted to the user space repository.

16. The non-transitory computer-readable medium of claim 15, wherein the message is received based at least in part on detection of a modification of a mapping of a cache location to a memory location by the user space library.

17. The non-transitory computer-readable medium of claim 15 or 16, wherein the cache comprises an instruction cache and the instructions comprise assembly instructions.

18. The non-transitory computer readable medium of any one of claims 15-17, wherein the operations further comprise: detecting instruction classes of instructions stored in the cache; determining a frequency of instances of the instruction in the cache; assigning a weight to the instruction based at least in part on the class; as well as A likelihood of a ransomware attack is determined based at least in part on the weight.

19. The non-transitory computer readable medium of any one of claims 15-18, wherein the operations further comprise: generating a first cryptographic degree map including a first row of encryption-related data associated with the cache, and generating a second cryptographic degree map including a second row of encryption-related data associated with the cache, wherein the first row is associated with the instruction; performing a mathematical exclusive-OR operation on the first row and the second row to derive a change value; comparing the derived change value to a threshold change value; as well as A determination is made based on the comparison whether the likelihood of a ransomware attack is a false positive.

20. The non-transitory computer-readable medium of any one of claims 15-19, wherein the operations further comprise registering a callback function, and wherein the first message is based at least in part on the callback function.

Images