Real-time monitoring of ransomware attacks using exception level transition metrics

Abstract

Aspects of the present disclosure include dynamic cloud workload reassignment based on active ransomware attacks. An example method includes receiving a first message that a compute instance may be infected by ransomware. The method also includes receiving a security state-based metric related to the compute instance based at least in part on the first message. The method also includes comparing the security state-based metric to a threshold metric. The method also includes determining a likelihood of a ransomware attack based at least in part on the comparison. The method also includes transmitting a second message to the job scheduler to rescheduling workload for the compute instance based at least in part on the determination.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of priority to U.S. non-provisional application serial number 17 / 743,950, filed on May 13, 2022; the disclosure of which is hereby incorporated by reference in its entirety for all purposes. Technical Field

[0003] The present application relates to the field of security monitoring in a network, and more particularly to real-time monitoring of ransomware attacks in the network using abnormal level transition metrics. Background Art

[0004] The cloud computing environment includes a combination of the cloud computing infrastructure layer, the cloud platform layer, and the application layer. Each of these layers also includes sub-elements to allow the cloud computing system to deliver services to its customers. Each of these cloud computing layers and elements may provide bad actors with opportunities to subvert security measures and harm the operation of the cloud computing environment. Summary of the invention

[0005] The present embodiments relate to dynamic cloud workload reallocation based on active ransomware attacks. A first example embodiment provides a computer-implemented method for dynamic workload reallocation. The method may include receiving, by a cloud infrastructure node, a first message that a computing instance may be infected by ransomware.

[0006] The computer-implemented method may also include receiving, by the cloud infrastructure node, a security status-based metric associated with the computing instance based at least in part on the first message.

[0007] The computer-implemented method may also include comparing, by the cloud infrastructure node, the metric based on the security status to a threshold metric.

[0008] The computer-implemented method may also include determining, by the cloud infrastructure node, a likelihood of a ransomware attack based at least in part on the comparison.

[0009] The computer-implemented method may also include transmitting, by the cloud infrastructure node to the job scheduler, a second message to reschedule the workload for the compute instance based at least in part on the determination.

[0010] A second embodiment relates to a cloud infrastructure node. The cloud infrastructure node may include a processor and a non-transitory computer-readable medium. The non-transitory computer-readable medium may include instructions that, when executed by the processor, cause the processor to receive a first message that a computing instance may be infected by ransomware.

[0011] The instructions may also cause the processor to receive a security status-based metric associated with the computing instance based at least in part on the first message.

[0012] The instructions may also cause the processor to compare the metric based on the security status to a threshold metric.

[0013] The instructions may also cause the processor to determine a likelihood of a ransomware attack based at least in part on the comparison.

[0014] The instructions may also cause the processor to transmit a second message to the job scheduler to reschedule the workload for the compute instance based at least in part on the determination.

[0015] A third embodiment relates to a non-transitory computer-readable medium. The non-transitory computer-readable medium may include a sequence of instructions stored thereon, which, when executed by a processor, causes the processor to perform a process. The process may include receiving a first message that a computing instance may be infected with ransomware.

[0016] The process may also include receiving a security status-based metric associated with the computing instance based at least in part on the first message.

[0017] The processing may also include comparing the security status-based metric to a threshold metric.

[0018] The processing may also include determining a likelihood of a ransomware attack based at least in part on the comparison.

[0019] The process may also include transmitting a second message to the job scheduler to reschedule the workload for the compute instance based at least in part on the determination. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 is a block diagram of a system for identifying ransomware according to one or more embodiments.

[0021] Figure 2 is a block diagram of a system for repaving according to one or more embodiments.

[0022] Figure 3 is a block diagram illustrating exception levels of a system according to one or more embodiments.

[0023] Figure 4 is a block diagram illustrating a system having elements in a secure state and an unsecure state according to one or more embodiments.

[0024] Figure 5 is a signaling diagram for identifying ransomware according to one or more embodiments.

[0025] Figure 6 is a signaling diagram for identifying ransomware according to one or more embodiments.

[0026] Figure 7 is a signaling diagram for identifying ransomware according to one or more embodiments.

[0027] Figure 8 is a block diagram of a process for identifying ransomware according to one or more embodiments.

[0028] Fig. 9 is a block diagram of a process for identifying ransomware according to one or more embodiments.

[0029] Fig.10 is a block diagram illustrating one mode for implementing a cloud infrastructure as a service system according to at least one embodiment.

[0030] Fig.11 is a block diagram illustrating another mode for implementing a cloud infrastructure as a service system according to at least one embodiment.

[0031] Fig.12 is a block diagram illustrating another mode for implementing a cloud infrastructure as a service system according to at least one embodiment.

[0032] Fig.13 is a block diagram illustrating another mode for implementing a cloud infrastructure as a service system according to at least one embodiment.

[0033] Fig.14 is a block diagram illustrating an example computer system in accordance with at least one embodiment. DETAILED DESCRIPTION

[0034] In the following description, various embodiments will be described. For the purpose of explanation, specific configurations and details are set forth to provide a thorough understanding of the embodiments. However, it will be apparent to those skilled in the art that the embodiments may be practiced without the specific details. In addition, well-known features may be omitted or simplified to avoid obscuring the described embodiments.

[0035] Many cloud computing systems are vulnerable to active security vulnerabilities, such as ransomware attacks. Ransomware attacks can include malicious memory / disk encryption using secret keys. In addition, ransomware attackers can encrypt client data and hold the data for a ransom. Failure to provide the ransom may result in the deletion of client data or the inappropriate dissemination of client data.

[0036] Ransomware attacks have evolved to the point where many attacks can bypass standard antivirus protection. In addition, ransomware can be designed to attack specific targets, such as the hardware of a cloud computing system. Three example ransomware attacks include full disk encryption, broken object level authorization (BOLA), and Rowhammer-style attacks. Laptops and servers are particularly vulnerable to these hardware-level ransomware attacks. Once a laptop or server connected to a cloud environment is successfully attacked by ransomware, the laptop or server may become a portal for malicious programs to cause further damage to the cloud system.

[0037] Embodiments of the present disclosure solve the above problems by customizing a detection mechanism to distinguish between transient encryption / decryption and persistent encryption / decryption, wherein transient encryption / decryption is based on legitimate transactions, while persistent encryption / decryption indicates a ransomware attack. The detection mechanism can detect a trigger that a ransomware has infected a cloud computing instance. Once the detection mechanism is triggered, the mechanism can collect data related to the security state (e.g., secure state and non-secure state) of the cloud infrastructure node. The detection mechanism can also determine whether a ransomware attack may have occurred based on the security state data.

[0038] Figure 1 1 is a block diagram illustrating an example system 100 for identification and mitigation of ransomware attacks in a cloud computing infrastructure 102. The system 100 may include a system monitor 104 for detecting and monitoring encryption / decryption of assembly instructions at a kernel level. The system monitor 104 may detect and monitor encryption instructions, for example, when instructions are read from memory into an instruction cache or when assembly level instructions are executed. The system monitor 104 may include low-level memory monitoring resources to detect encryption / decryption instructions. The system monitor 102 may read memory lines to identify any encryption instructions provided to the memory. The encryption / decryption instructions may be aggregated to determine whether a threshold number of changes have occurred in the memory, thereby verifying a ransomware attack at the memory. The system monitor 104 may also monitor the security state of processing elements (PEs) of the cloud computing infrastructure 102. For example, the system monitor may detect when the PE is in a secure state or a non-secure state.

[0039] The system 100 may also include a user space library 106, which includes a collection of functions that can initiate monitoring of low-level memory. The user space library 106 can be software that enables communication between an operating system and an application executed on the operating system. In some embodiments, the user space library 106 can be reused across libraries at the platform layer of the cloud environment.

[0040] The system 100 may also include a memory converter 108. The memory converter 108 may interact with the memory map to provide cache mapping and unmapping functions to the application. Each time an application is introduced to a cloud computing instance in the cloud, the application provides a set of instructions for interacting with the hardware. The memory converter 108 may guide the application in terms of, for example, placement and replacement policies, and read and write policies for instructions provided by the application.

[0041] System 100 may interact with application 110. Application 110 may potentially include ransomware that maliciously encrypts data within a cloud computing infrastructure.

[0042] refer to Figure 2 , a resurfacing system 200 for migrating computing resources (e.g., or workloads), erasing memory, and making requests to perform computing tasks from affected computing instances is shown. Resurfacing may include restoring the state of an instance to a state before the security vulnerability. For example, if ransomware has been introduced into the workload, a repaver 202 may restore the state of the workload. The repaver 202 may also migrate the workload from an instance affected by the ransomware to an unaffected instance. The repaver 202 may include a host-level resurfacing unit 204 for resurfacing resources at the host level and a container-level resurfacing unit 206 for resurfacing resources at the container level. The host-level resurfacing unit 204 may include a workload migration unit 208 for resurfacing workloads from affected computing instances at the host level. In addition, the host-level resurfacing unit 204 may include a restart host image unit 210 for resurfacing a host image for an affected computing instance. The container-level resurfacing unit 206 may include a workload migration and cluster (pod) migration module 212 for resurfacing workloads from affected computing instances.

[0043] refer to Figure 3, an example system 300 with indicated exception levels according to some embodiments is shown. As shown, system 200 may include a user application 202 operating at exception level 0 204 (ELO), an operating system 206 operating at exception level one 208 (EL1), a hypervisor 210 operating at exception level two 212 (EL2), and a firmware 214 operating at exception level three 216 (EL3). Different applications may be associated with different modules, each of which has a different access privilege level to system or processor resources. As shown, the exception level is associated with a privilege level for accessing system and processor resources. For example, an operating system 206 operating at EL1 208 may have a higher access level to system and processor resources than a user application 202 operating at EL0 204. With respect to the embodiments described herein, the EL may indicate that the privileges of an application are often associated with the current EL. In conventional implementations, user applications may operate at a low level of privilege, where access to system and processor resources is most restricted, the operating system may operate at a medium level of privilege, where access to system and processor resources is less restricted than the low level of privilege, and firmware may operate at a high level of privilege, where access to system and processor resources is least restricted. It should be appreciated that EL states are not static, and a PE may operate in a first EL state in one instance and in a second EL state in another instance.

[0044] The EL may affect an application's access to both memory and processor resources. Applications can assign attributes to different memory regions, including read / write permissions. Attributes can also be configured to allow separate access permissions for privileged and non-privileged access. For example, if a processor is acting at EL0 and attempts to access memory, the access attempt can be checked against non-privileged access permissions. However, if the processor is acting at EL1 or higher, the access attempt is checked against privileged access permissions. In addition to memory, access to system registers can also be based on the EL. For example, system registers that hold the configuration of the system can be configured to be accessed only based on the EL.

[0045] refer to Figure 4, a diagram 400 is shown for describing the EL, security state, and execution state of a system according to some embodiments. The state of the processor may depend on the EL and the execution state. The execution state may define the general width of the registers and the available instruction set. The processor architecture may allow multiple execution states to be implemented. The security state may determine which EL is currently valid. The processor architecture may also allow different security states (e.g., a secure state and an unsecure state). For example, the processor architecture may allow a secure state in which the processor can access secure and unsecure system registers. The processor architecture may allow an unsecure state in which the processor can access an unsecure address space.

[0046] like Figure 4 As seen in , elements of a cloud computing system are illustrated to show the EL and security states. As shown, the first execution state user application one 402, the second execution state user application 404, the second execution state kernel 406, the first execution state user application two 408, the first execution state kernel 410, and the hypervisor are in a non-secure state. The first execution state can be, for example, a 32-bit state, and the second execution state can be, for example, a 64-bit execution state. For illustration, each element in the non-secure state is shown as a rectangle. As further shown, the trusted service 414, the trusted operating system 416, and the firmware 418 are in a secure state. For illustration purposes, the secure state elements are shown as rounded rectangles. As further shown, each element can also be associated with an EL, such as with respect to Figure 3 As described above. Each element can access system and processor resources based on its execution state, EL, and security state. For example, hypervisor 412 can access non-secure address space at EL2 permission level. On the other hand, firmware 418 can access secure memory at EL3 permission level.

[0047] refer to Figure 5, a signaling diagram 500 for identifying a ransomware attack according to some embodiments is shown. As shown, an instruction detector 502, a cloud platform control plane 504, a resurfacer 506, and a logging service 508 can communicate operably. Although the operations of processing 500, 600, 700, 800, 900, and 1000 are described as being performed by a general-purpose computer, it should be understood that any suitable device (e.g., a user device, a server device) can be used to perform one or more operations in these processes. Processing 500, 600, 700, 800, 900, and 1000 (described below) are respectively shown as logical flow charts, each of which represents a sequence of operations that can be implemented with hardware, computer instructions, or a combination thereof. In the context of computer instructions, an operation represents a computer executable instruction stored on one or more computer-readable storage media, and the computer executable instruction performs the stated operation when executed by one or more processors. In general, computer executable instructions include routines, programs, objects, components, data structures, etc. that perform specific functions or implement specific data types. The order in which the operations are described is not intended to be construed as a limitation, and any number of the described operations may be combined in any order and / or in parallel to implement the processes.

[0048] At 510, the instruction detector 502 may transmit an indication that a memory encryption trigger has occurred to the cloud platform control plane 504. This may be performed in response to verifying the instruction as possibly including a ransomware attack. For example, a threshold number of modifications between the cache and the memory are detected to have occurred.

[0049] At 512, the cloud platform control plane 504 may initiate a first workflow. The first workflow may allow identification of victim computing instances and identification of other computing instances that may be used to take over the workload. For example, the cloud platform control plane 504 may identify available resources across cloud infrastructure services. Identification may be based on comparing metrics to key performance indicators (KPIs). Metrics may be collected from application profiles, system usage (e.g., duration, how often instances are created, the number of user logins, and other disk-level thresholds) and / or based on application profiles, system usage. KPIs may be based on the security status of one or more PEs. For example, the number of times a processor calls EL indicates a security status. For example, in some instances, EL3 indicates a security status. Therefore, if a processor changes from an EL2, EL1, or EL0 state to an EL3 state, this indicates a move from an unsafe state to a safe state. The safe state may then indicate that encryption / decryption is occurring. Another KPI may be the length of time a node operates in a safe state. Yet another KPI may be the number of times a transition to a safe state fails. Yet another KPI may be the number of requests for calling a safe state transition that returned an "excessive request error."

[0050] In response to not detecting any instructions related to encryption, the result can indicate that encryption was not detected. Alternatively, if an instruction to encrypt data is detected, then the change in memory content of each chunk of the memory row can be calculated. The result can be compared to a threshold to determine whether the instruction exceeds a threshold amount. In addition, the result can be processed to determine whether the instruction includes a false positive. In response to the result being verified, indicating that a ransomware attack may have occurred, a trigger can be created to resurface the victim computing instance, migrate the workload to an unaffected instance, and modify the scheduler to not schedule the workload on the affected instance.

[0051] In some instances, instructions for encrypting and decrypting data can be analyzed to verify the results and remove false positive instances of possible ransomware attacks identified via cryptographic bitmaps. As described above, the user space library can observe the cache within a configurable time window. For example, the user space library can observe the data written to and read from the cache within a three-second time window. The user space library can further retrieve historical data from the cache within a similar time window. Assuming that no malicious encryption was observed at the time, the historical data is used as a benchmark for the current data. The user space library can compare two data sets and determine whether the difference (e.g., delta) between the two data sets indicates that malicious encryption has occurred.

[0052] In some embodiments, a cryptographic bitmap may be generated to include a bitmap of instructions identified for each memory row. A mathematical exclusive OR (XOR) operation may be performed on the bitmaps of adjacent memory rows. Incremental values ​​may be derived as a result of the XOR operation of each set of adjacent bitmaps, and the sum of the incremental values ​​may be derived by aggregating the incremental values. If the sum of the accumulated incremental values ​​exceeds a threshold, encryption / decryption may be identified. Alternatively, the system may continue to accumulate instructions identified in the memory set. In some instances, data analysis functions (such as minimum, maximum, standard deviation) may be used to derive possible threshold variants.

[0053] At 514, the cloud platform control plane 504 may send a notification to transition available resources to a different node / cluster to the cloud resurfacer mechanism 506. The notification may identify the victim resource and request that the workload be transitioned to the identified resource.

[0054] At 516, the cloud platform control plane 504 may send an instruction to update the scheduler to the resurfacer 506. This scheduler may exclude the victim cluster / node / compute instance from obtaining / executing the corresponding workload.

[0055] At 518, cloud platform control plane 504 may send a cloud control plane response to ransomware instruction detector 502. This may be sent in response to updating the scheduler and transitioning resources.

[0056] At 520, instruction detector 502 may update the encryption KPI. This may be performed in response to successful receipt of the cloud control plane response at 518. Updating the encryption KPI may include updating the memory map with the type of memory, encryption type, and address ranges / buckets.

[0057] At 522, instruction detector 502 may send an error message to logging service 508. This may be sent if a failure occurred while updating the bitmap.

[0058] At 524 , the instruction detector 502 may send a status of whether the memory has been swept to the cloud platform control plane 504 .

[0059] At 526, a second workflow is initiated at the cloud platform control plane 504. The second workflow may include state transitions and database updates.

[0060] At 528, the cloud platform control plane 504 may send a notification to the cloud resurfacing mechanism 506 to continue with the resurfacing schedule if the memory sweep is not completed. The same schedule may continue with the same set of resurfacing nodes and the same resurfacing algorithm.

[0061] In some embodiments, randomness and statistical profiling of memory zones may be introduced to identify malicious encryption. Memory may be provided in different zones (e.g., cache or main memory). Caches are further subdivided into cache levels, such as level 1 cache, level 2 cache, and level 3 cache. In some embodiments, level 1 cache may also include an instruction cache and a data cache. Ransomware may be configured to infect specific memory, e.g., a data cache or a level 2 cache. In addition, during a ransomware attack, the corresponding percentage of maliciously encrypted data in different caches is different for each cache. Therefore, in order to introduce a baseline for a cache (e.g., an instruction cache, a data cache, and a level 2 cache), the cache is statistically profiled and sampled.

[0062] The embodiments described herein may employ various statistical profiling techniques for each cache. For example, the embodiments described herein may employ statistical profiling extension (SPE) techniques. Using SPE, the processor may select from a set of operations being executed in the processor pipeline. These operations may be, for example, architecture instructions or micro-operations and may be tracked along the processor pipeline. The processor may also implement sampling intervals for collecting data. Each time a sample is collected, the data is stored in a memory buffer according to the interval. Each instance of the buffer being filled is an indication for the software to process the data.

[0063] Statistical profiling enables a non-intrusive method of sampling software and hardware using randomized sampling of each cache. The sampling can be an architectural instruction as defined by the instruction set architecture, or a micro-architectural operation. In some instances, the processor is sampling multi-threaded processing. In these instances, the sampling interval is determined for each thread being profiled. The sampled data can also be compared against a threshold (e.g., a threshold based on a KPI).

[0064] In some embodiments, the method described herein can be applied to different encryption / decryption categories. For example, the method can be applied to single encryption and decryption, multiple encryption and decryption, cache encryption including instruction cache and data cache encryption, and associated encryption failures.

[0065] In some embodiments, different encryption categories can be associated with different thresholds for identifying ransomware attacks. In other words, different KPIs are established based on encryption categories, such as KPIs based on security status. For example, a weighted average threshold can be applied to single and multiple encryptions and decryptions. For each encryption and decryption identified, an exponential mathematical equation can be applied. Calculating this equation can result in a cumulative sum of floating point numbers. Calculating this score can even be for transient encryption and decryption, which can be recovered at a lower level of software / hardware. Once these floating point numbers are averaged, the following processes 600 and 700 can be performed.

[0066] refer to Figure 6, a process 600 for identifying ransomware according to some embodiments is shown. As shown, a KPI manager 602, a user space library 604, a resurfacer 606, and a logging service 608 can communicate. At 610, the KPI manager 602 can register for callbacks and notifications from the user space library 604. This registration can be for instruction caches, data caches, overall DRAM, and other memory computing instances of interest. In addition, during workload operations, security state information can be mapped to corresponding host instances, thread counts, and workload profiles. This can be replicated across cloud computing environments, and threads can be verified against malicious and legitimate encryption situations.

[0067] At 612, KPI manager 602 may install a driver with a low-level kernel (e.g., kernel image). This may include registering memory devices (e.g., cache, DRAM) for monitoring. This may also establish a communication channel or suspend a communication channel until a triggering event occurs.

[0068] At 614, KPI manager 602 may send a notification to user space library 604 to maintain a session of the detection mechanism. User space library 604 may be a collection of functions configured for ransomware detection. This may include notifications of configuration changes for refreshing or scanning the detection mechanism. This may also include confirmation that the driver has been installed with the low-level kernel.

[0069] At 616, the KPI manager 602 can calculate one or more scores. The scores can include encryption category scores and location-based scores, such as a single encryption score, a multiple encryption score, and scores for instruction caches and data caches. The scores can change based on the difference between the number of encryptions and the number of decryptions. This can include comparing the scores to previously calibrated scores (e.g., based on a threshold score for the KPI). In some instances, as the encryption increment grows over time (e.g., more instructions are identified for encryption than for decryption), a multiplier can be assigned to the score.

[0070] At 618, KPI manager 602 may update the cloud scheduler to cloud resurfacer mechanism 606. If indications of ransomware are detected based on the score comparison, updating the cloud scheduler may include excluding a cluster, node, or compute instance.

[0071] At 620 , if the cryptographic bitmap is successfully updated, the KPI manager 602 may send a cloud control plane response to the user space library 604 indicating success.

[0072] At 622, the user space library 604 may update the security state related KPIs. This may be performed in response to successful receipt of the cloud control plane response 620. Updating the encryption KPIs may include updating the memory map with the type of memory, encryption type, and address ranges / buckets.

[0073] At 624, if updating the cryptographic bitmap fails, the user space library 604 may send an error message to the logging service 608. This may be sent in response to an encryption bitmap update failure.

[0074] At 626 , the user space library 604 may provide the KPI manager 602 with the status of whether the memory has been swept.

[0075] At 628, KPI manager 602 can initiate a second workflow. The second workflow can include identifying security state transitions and updating a database.

[0076] At 630, KPI manager 602 may send a message to cloud resurfacer 806 to continue with the resurfacer schedule if the memory sweep is not complete. The same schedule may continue with the same set of resurfacer nodes and the same resurfacer algorithm.

[0077] refer to Figure 7 , shows a signaling diagram 700 for identifying a ransomware attack according to some embodiments. At 710, a user space detector 702 can transmit an indication that a memory encryption trigger has occurred to a cloud platform control plane 704. The cloud platform control plane 704 can be a node in a cloud computing system. This can be performed in response to verifying that the instruction may include a ransomware attack. For example, determining that the number of transitions to a secure state has exceeded a threshold number of times for entering a secure state.

[0078] At 712, the cloud platform control plane 704 can initiate a first workflow. The first workflow can allow identification of a victim computing instance and identification of other computing instances that can be used to take over the workload. For example, the cloud platform control plane 704 can identify available resources across CI services. As described above, the identification can be based on comparing the metrics to a KPI based on the security state. In some embodiments, as described above, the cloud platform control plane 704 can identify a false positive.

[0079] At 714, the cloud platform control plane 704 may send a notification to transition available resources to a different node / cluster to the resurfacer 706. The notification may identify the victim resource and request that the workload be transitioned to the identified resource.

[0080] At 716, the cloud platform control plane 704 may send an instruction to update the scheduler to the resurfacer 706. This scheduler may exclude the victim cluster / node / compute instance from obtaining / executing the corresponding workload.

[0081] At 718, the cloud platform control plane 704 may send a cloud platform control plane response to the user space detector 702. This may be sent in response to updating the scheduler and transitioning resources.

[0082] At 720, the user space detector 702 may update the encryption KPI. This may be performed in response to successful receipt of the cloud control plane response at 718. Updating the encryption KPI may include updating the memory map with the type of memory, encryption type, and address ranges / buckets.

[0083] At 722, the user space detector 702 may send an error message to the logging service 708. This may be sent if a failure occurred while updating the bitmap.

[0084] At 724 , the user space detector 702 may send a status of whether the memory has been cleared to the cloud platform control plane 704 .

[0085] At 726, a second workflow is initiated at the cloud platform control plane 704. The second workflow may include state transitions and database updates.

[0086] At 728, the cloud platform control plane 704 may send a notification to the resurfacing device 506 to continue with the resurfacing schedule if the memory sweep is not completed. The same schedule may be continued with the same set of resurfacing nodes and the same resurfacing algorithm.

[0087] Figure 8 A process 800 for identifying a ransomware attack according to some embodiments is illustrated. At 802, a computing device may receive an indication that a computing instance is infected by ransomware. The indication may be based on, for example, a modification of a memory mapping from a cache to a system memory. The indication may also be based on a number of attempted transitions from an unsecure state to a secure state.

[0088] At 804, the computing device may receive metrics related to the security state. The metrics may be collected from another entity and based on application profiles, system usage (e.g., duration, frequency of instance creation, number of user logins, and other disk level thresholds). The metrics may include, for example, the number of times the processor invokes an EL indicating a secure state. Another metric may be the length of time that the computing instance operates in a secure state. Yet another metric may be the number of times a transition to a secure state fails. Yet another metric may be the number of requests to invoke a secure state transition that returned a "too many requests error."

[0089] At 806 , the computing device can compare the collected metrics to a threshold based on the KPI. At 808 , if, based on the comparison, the computing device detects ransomware, process 800 proceeds to 810 .

[0090] At 810 , the computing device may notify a job scheduler to route future jobs away from the affected computing instance.

[0091] However, if the computing device does not detect ransomware, process 800 proceeds to 812. At 812, the computing device does not send a notification to the job scheduler to route future jobs away from the computing instance. Fig. 9 9 is a process flow for identifying ransomware according to one or more embodiments. At 902, the method may include a computing system receiving a first message that a computing instance may be infected by ransomware.

[0092] At 904 , the method can include receiving, at the computing system, a security status-based metric associated with the computing instance based at least in part on the first message.

[0093] At 906 , the method may include the computing device comparing the metric based on the security state to a threshold metric.

[0094] At 908 , the method may include determining, by the computing system, a likelihood of a ransomware attack based at least in part on a comparison of the metric based on the security state to a threshold metric.

[0095] At 910 , the method may include the computing system transmitting a second message to the job scheduler to reschedule the workload for the computing instance.

[0096] As noted above, Infrastructure as a Service (IaaS) is a specific type of cloud computing. IaaS can be configured to provide virtualized computing resources over a public network (e.g., the Internet). In the IaaS model, a cloud computing provider can host infrastructure components (e.g., servers, storage devices, network nodes (e.g., hardware), deployment software, platform virtualization (e.g., hypervisor layer), etc.). In some cases, IaaS providers can also provide various services to accompany these infrastructure components (example services include billing software, monitoring software, logging software, load balancing software, clustering software, etc.). Therefore, since these services can be policy-driven, IaaS users can be able to implement policies to drive load balancing to maintain the availability and performance of applications.

[0097] In some instances, IaaS customers can access resources and services over a wide area network (WAN) such as the Internet, and can use the cloud provider's services to install the remaining elements of the application stack. For example, a user can log in to the IaaS platform to create a virtual machine (VM), install an operating system (OS) on each VM, deploy middleware such as a database, create storage buckets for workloads and backups, and even install enterprise software into that VM. The customer can then use the provider's services to perform a variety of functions, including balancing network traffic, troubleshooting application problems, monitoring performance, managing disaster recovery, and more.

[0098] In most cases, the cloud computing model will require the involvement of a cloud provider. A cloud provider may, but need not, specialize in providing (e.g., provisioning, renting, selling) third-party IaaS services. An entity may also choose to deploy a private cloud, thereby becoming its own infrastructure service provider.

[0099] In some examples, IaaS deployment is the process of placing a new application or a new version of an application onto a prepared application server, etc. It may also include the process of preparing the server (e.g., installing libraries, daemons, etc.). This is typically managed by the cloud provider, below the hypervisor layer (e.g., servers, storage, network hardware, and virtualization). Thus, the customer may be responsible for handling (OS), middleware, and / or application deployment (e.g., on a self-service virtual machine (e.g., that can be started on demand), etc.).

[0100] In some examples, IaaS provisioning can refer to obtaining computers or virtual hosts for use, and even installing required libraries or services on them. In most cases, deployment does not include provisioning, and provisioning may need to be performed first.

[0101] In some cases, there are two different challenges for IaaS provisioning. First, there is the initial challenge of provisioning the initial set of infrastructure before anything is running. Second, once everything has been provisioned, there is the challenge of evolving the existing infrastructure (e.g., adding new services, changing services, removing services, etc.). In some cases, both of these challenges can be addressed by enabling configuration that defines the infrastructure in a declarative manner. In other words, the infrastructure (e.g., which components are required and how they interact) can be defined by one or more configuration files. Therefore, the overall topology of the infrastructure (e.g., which resources depend on which resources, and how they work together) can be described in a declarative manner. In some instances, once the topology is defined, workflows can be generated to create and / or manage the different components described in the configuration files.

[0102] In some examples, the infrastructure can have many interconnected elements. For example, there may be one or more virtual private clouds (VPCs) (e.g., a potential on-demand pool of configurable and / or shared computing resources), also referred to as a core network. In some examples, one or more inbound / outbound traffic group rules can also be provided to define how to set up the inbound / outbound traffic of the network and one or more virtual machines (VMs). Other infrastructure elements, such as load balancers, databases, etc., can also be provided. The infrastructure can evolve gradually as more and more infrastructure elements are desired and / or added.

[0103] In some instances, continuous deployment techniques may be employed to enable deployment of infrastructure code across various virtual computing environments. In addition, the described techniques may enable infrastructure management within these environments. In some examples, a service team may write code that is expected to be deployed to one or more but typically many different production environments (e.g., across various geographic locations, sometimes across the world). However, in some examples, the infrastructure on which the code will be deployed must first be set up. In some instances, provisioning may be done manually, resources may be provisioned using provisioning tools, and / or code may be deployed using deployment tools once the infrastructure is provisioned.

[0104] Fig.10 1 is a block diagram 1000 illustrating an example schema of an IaaS architecture according to at least one embodiment. A service operator 1002 can be communicatively coupled to a secure host lease 1004 that can include a virtual cloud network (VCN) 1006 and a secure host subnet 1008. In some examples, the service operator 1002 can use one or more client computing devices, which can be portable handheld devices (e.g., Cellular phone, computing tablets, personal digital assistants (PDAs), or wearable devices (e.g., Google head mounted display), running software (such as Microsoft Windows ) and / or various mobile operating systems (such as iOS, Windows Phone, Android, BlackBerry 8, Palm OS, etc.), and supports Internet, email, short message service (SMS), Alternatively, the client computing device may be a general-purpose personal computer, including, for example, a computer running various versions of Microsoft Apple The client computing device may be a personal computer and / or laptop computer running various commercially available or UNIX-like operating systems, including but not limited to any of the various GNU / Linux operating systems (such as, for example, Google Chrome OS). Alternatively or additionally, the client computing device may be any other electronic device, such as a thin client computer, an Internet-enabled gaming system (e.g., with or without gesture input device), and / or a personal messaging device capable of communicating over a network that can access VCN1006 and / or the Internet.

[0105] VCN 1006 may include a local peer gateway (LPG) 1010, which may be communicatively coupled to a secure shell (SSH) VCN 1012 via the LPG 1010 contained in the SSH VCN 1012. The SSH VCN 1012 may include an SSH subnet 1014, and the SSH VCN 1012 may be communicatively coupled to a control plane VCN 1016 via the LPG 1010 contained in the control plane VCN 1016. In addition, the SSH VCN 1012 may be communicatively coupled to a data plane VCN 1018 via the LPG 1010. The control plane VCN 1016 and the data plane VCN 1018 may be contained in a service lease 1019, which may be owned and / or operated by an IaaS provider.

[0106] The control plane VCN 1016 may include a control plane demilitarized zone (DMZ) layer 1020 that acts as a perimeter network (e.g., a portion of a corporate network between a corporate intranet and an external network). DMZ-based servers may have limited liability and help control vulnerabilities. In addition, the DMZ layer 1020 may include one or more load balancer (LB) subnets 1022, a control plane application layer 1024 that may include (one or more) application subnets 1026, and a control plane data layer 1028 that may include (one or more) database (DB) subnets 1030 (e.g., (one or more) front-end DB subnets and / or (one or more) back-end DB subnets). The LB subnet(s) 1022 included in the control plane DMZ layer 1020 may be communicatively coupled to the application subnet(s) 1026 included in the control plane application layer 1024 and the internet gateway 1034 that may be included in the control plane VCN 1016, and the application subnet(s) 1026 may be communicatively coupled to the DB subnet(s) 1030 included in the control plane data layer 1028 and the service gateway 1036 and the network address translation (NAT) gateway 1038. The control plane VCN 1016 may include the service gateway 1036 and the NAT gateway 1038.

[0107] The control plane VCN 1016 may include a data plane mirror application layer 1040, which may include application subnet(s) 1026. The application subnet(s) 1026 contained in the data plane mirror application layer 1040 may include a virtual network interface controller (VNIC) 1042 that may execute a compute instance 1044. The compute instance 1044 may communicatively couple the application subnet 1026 of the data plane mirror application layer 1040 to the application subnet(s) 1026 that may be contained in the data plane application layer 1046.

[0108] The data plane VCN 1018 may include a data plane application layer 1046, a data plane DMZ layer 1048, and a data plane data layer 1050. The data plane DMZ layer 1048 may include (one or more) LB subnets 1022, which may be communicatively coupled to (one or more) application subnets 1026 of the data plane application layer 1046 and an internet gateway 1034 of the data plane VCN 1018. The (one or more) application subnets 1026 may be communicatively coupled to a service gateway 1036 of the data plane VCN 1018 and a NAT gateway 1038 of the data plane VCN 1018. The data plane data layer 1050 may also include (one or more) DB subnets 1030, which may be communicatively coupled to (one or more) application subnets 1026 of the data plane application layer 1046.

[0109] The internet gateway 1034 of the control plane VCN 1016 and the data plane VCN 1018 may be communicatively coupled to the metadata management service 1052, and the metadata management service 1052 may be communicatively coupled to the public Internet 1054. The public Internet 1054 may be communicatively coupled to the NAT gateway 1038 of the control plane VCN 1016 and the data plane VCN 1018. The service gateway 1036 of the control plane VCN 1016 and the data plane VCN 1018 may be communicatively coupled to the cloud service 1056.

[0110] In some examples, service gateway 1036 of control plane VCN 1016 or data plane VCN 1018 can make application programming interface (API) calls to cloud services 1056 without traversing public internet 1054. API calls from service gateway 1036 to cloud services 1056 can be one-way: service gateway 1036 can make API calls to cloud services 1056, and cloud services 1056 can send requested data to service gateway 1036. However, cloud services 1056 may not initiate API calls to service gateway 1036.

[0111] In some examples, secure host lease 1004 can be directly connected to service lease 1019, which otherwise can be isolated. Secure host subnet 1008 can communicate with SSH subnet 1014 through LPG 1010, which can enable two-way communication on otherwise isolated systems. Connecting secure host subnet 1008 to SSH subnet 1014 can give secure host subnet 1008 access to other entities within service lease 1019.

[0112] The control plane VCN 1016 may allow a user of the service lease 1019 to set up or otherwise provision desired resources. The desired resources provided in the control plane VCN 1016 may be deployed or otherwise used in the data plane VCN 1018. In some examples, the control plane VCN 1016 may be isolated from the data plane VCN 1018, and the data plane mirror application layer 1040 of the control plane VCN 1016 may communicate with the data plane application layer 1046 of the data plane VCN 1018 via the VNIC 1042, which may be included in the data plane mirror application layer 1040 and the data plane application layer 1046.

[0113] In some examples, a user or customer of the system may issue a request, such as a create, read, update, or delete (CRUD) operation, over the public internet 1054, which may transmit the request to the metadata management service 1052. The metadata management service 1052 may transmit the request to the control plane VCN 1016 via the internet gateway 1034. The request may be received by the LB subnet(s) 1022 contained in the control plane DMZ layer 1020. The LB subnet(s) 1022 may determine that the request is valid, and in response to this determination, the LB subnet(s) 1022 may send the request to the application subnet(s) 1026 contained in the control plane application layer 1024. If the request is valid and requires a call to the public internet 1054, the call to the public internet 1054 may be transmitted to the NAT gateway 1038, which may make the call to the public internet 1054. The metadata that the request may desire to be stored may be stored in the DB subnet(s) 1030.

[0114] In some examples, data plane mirror application layer 1040 may facilitate direct communication between control plane VCN 1016 and data plane VCN 1018. For example, it may be desirable to apply changes, updates, or other suitable modifications to a configuration to resources contained in data plane VCN 1018. Control plane VCN 1016 may communicate directly with resources contained in data plane VCN 1018 via VNIC 1042, and may thereby perform changes, updates, or other suitable modifications to a configuration on resources contained in data plane VCN 1018.

[0115] In some embodiments, control plane VCN 1016 and data plane VCN 1018 may be included in service lease 1019. In this case, a user or customer of the system may not own or operate control plane VCN 1016 or data plane VCN 1018. Alternatively, an IaaS provider may own or operate control plane VCN 1016 and data plane VCN 1018, both of which may be included in service lease 1019. This embodiment may enable isolation of networks, which may prevent a user or customer from interacting with the resources of other users or other customers. Furthermore, this embodiment may allow a user or customer of the system to store a database privately without relying on the public Internet 1054 for storage, which may not have the desired level of threat protection.

[0116] In other embodiments, the LB subnet(s) 1022 contained in the control plane VCN 1016 can be configured to receive signals from the service gateway 1036. In this embodiment, the control plane VCN 1016 and the data plane VCN 1018 can be configured to be called by customers of the IaaS provider without calling the public Internet 1054. Customers of the IaaS provider may desire this embodiment because the database(s) used by the customer can be controlled by the IaaS provider and can be stored on the service lease 1019, which can be isolated from the public Internet 1054.

[0117] Fig.11 1 is a block diagram 1100 illustrating another example model of an IaaS architecture according to at least one embodiment. A service operator 1102 (e.g., Fig.10 The service operator 1002 may be communicatively coupled to the secure host lease 1104 (e.g., Fig.10 The secure host lease 1004 may include a virtual cloud network (VCN) 1106 (e.g., Fig.10 VCN 1006) and secure host subnet 1108 (e.g., Fig.10The VCN 1106 may include a local peer gateway (LPG) 1110 (e.g., Fig.10 LPG 1010), which may be accessed via a secure shell (SSH) VCN 1112 (e.g., Fig.10 LPG 1010 in SSH VCN 1012 of the present invention is communicatively coupled to SSH VCN 1112. SSH VCN 1112 may include SSH subnet 1114 (e.g., Fig.10 SSH subnet 1014 of the control plane VCN 1114), and SSH VCN 1112 can be communicatively coupled to control plane VCN 1116 via LPG 1110 contained in control plane VCN 1116 (e.g., Fig.10 The control plane VCN 1116 may be included in the service lease 1119 (e.g., Fig.10 service lease 1019), and the data plane VCN 1118 (e.g., Fig.10 The data plane VCN 1018) may be contained in a customer lease 1121 which may be owned or operated by a user or customer of the system.

[0118] The control plane VCN 1116 may include a LB subnet 1122 (e.g., Fig.10 The control plane DMZ layer 1120 (e.g., Fig.10 The control plane DMZ layer 1020 may include (one or more) application subnets 1126 (e.g., Fig.10 (one or more) application subnets 1026) of the control plane application layer 1124 (e.g., Fig.10 The control plane application layer 1024 of FIG. 1024 may include (one or more) database (DB) subnets 1130 (e.g., similar to Fig.10 (one or more) DB subnets 1030) of the control plane data layer 1128 (e.g., Fig.10 1028). The LB subnet(s) 1122 contained in the control plane DMZ layer 1120 may be communicatively coupled to the application subnet(s) 1126 contained in the control plane application layer 1124 and the internet gateway 1134 (e.g., Fig.10 1034), and the application subnet(s) 1126 may be communicatively coupled to the DB subnet(s) 1130 and the service gateway 1136 (e.g., Fig.10Serving gateway 1036) and network address translation (NAT) gateway 1138 (e.g., Fig.10 The control plane VCN 1116 may include a service gateway 1136 and a NAT gateway 1138.

[0119] The control plane VCN 1116 may include a data plane mirror application layer 1140 (e.g., Fig.10 The data plane image application layer 1040 of FIG. 1040 may include (one or more) application subnets 1126. The (one or more) application subnets 1126 included in the data plane image application layer 1140 may include a virtual network interface controller (VNIC) 1142 (e.g., the VNIC of 1042), which may execute a computing instance 1144 (e.g., similar to Fig.10 The compute instance 1144 can facilitate the communication between the (one or more) application subnets 1126 of the data plane mirror application layer 1140 and the application subnets 1126 that can be included in the data plane application layer 1146 (e.g., Fig.10 The (one or more) application subnets 1126 in the data plane application layer 1046) communicate via the VNIC 1142 contained in the data plane mirror application layer 1140 and the VNIC 1142 contained in the data plane application layer 1146.

[0120] The Internet gateway 1134 included in the control plane VCN 1116 can be communicatively coupled to the metadata management service 1152 (e.g., Fig.10 1052), which can be communicatively coupled to a public Internet 1154 (e.g., Fig.10 The public Internet 1154 can be communicatively coupled to a NAT gateway 1138 included in the control plane VCN 1116. The service gateway 1136 included in the control plane VCN 1116 can be communicatively coupled to cloud services 1156 (e.g., Fig.10 Cloud service 1056).

[0121] In some examples, the data plane VCN 1118 may be contained in a customer lease 1121. In this case, the IaaS provider may provide a control plane VCN 1116 for each customer, and the IaaS provider may provision each customer with a unique compute instance 1144 contained in a service lease 1119. Each compute instance 1144 may allow communication between the control plane VCN 1116 contained in the service lease 1119 and the data plane VCN 1118 contained in the customer lease 1121. The compute instance 1144 may allow resources provisioned in the control plane VCN 1116 contained in the service lease 1119 to be deployed or otherwise used in the data plane VCN 1118 contained in the customer lease 1121.

[0122] In other examples, a customer of the IaaS provider may have a database that exists in the customer tenancy 1121. In this example, the control plane VCN 1116 may include a data plane mirror application layer 1140, which may include (one or more) application subnets 1126. The data plane mirror application layer 1140 may reside in the data plane VCN 1118, but the data plane mirror application layer 1140 may not be in the data plane VCN 1118. That is, the data plane mirror application layer 1140 may access the customer tenancy 1121, but the data plane mirror application layer 1140 may not exist in the data plane VCN 1118 or be owned or operated by the customer of the IaaS provider. The data plane mirror application layer 1140 may be configured to make calls to the data plane VCN 1118, but may not be configured to make calls to any entity contained in the control plane VCN 1116. A customer may desire to deploy or otherwise use resources provisioned in control plane VCN 1116 in data plane VCN 1118, and data plane mirror application layer 1140 may facilitate the customer's desired deployment or other use of resources.

[0123] In some embodiments, a customer of an IaaS provider may apply filters to the data plane VCN 1118. In this embodiment, the customer may determine what the data plane VCN 1118 may access, and the customer may restrict access to the public Internet 1154 from the data plane VCN 1118. The IaaS provider may not apply filters or otherwise control access to any external network or database by the data plane VCN 1118. The customer applying filters and controls to the data plane VCN 1118 contained in the customer lease 1121 may help isolate the data plane VCN 1118 from other customers and the public Internet 1154.

[0124] In some embodiments, cloud services 1156 may be called by service gateway 1136 to access services that may not exist on public Internet 1154, control plane VCN 1116, or data plane VCN 1118. The connection between cloud services 1156 and control plane VCN 1116 or data plane VCN 1118 may not be real-time or continuous. Cloud services 1156 may exist on different networks owned or operated by IaaS providers. Cloud services 1156 may be configured to receive calls from service gateway 1136 and may be configured not to receive calls from public Internet 1154. Some cloud services 1156 may be isolated from other cloud services 1156, and control plane VCN 1116 may be isolated from cloud services 1156 that may not be in the same region as control plane VCN 1116. For example, control plane VCN 1116 may be located in "Region 1", and cloud service "Deployment 10" may be located in Region 1 and "Region 2". If a service gateway 1136 contained in a control plane VCN 1116 located in region 1 makes a call to a deployment 10, the call may be transmitted to the deployment 10 in region 1. In this example, the control plane VCN 1116 or the deployment 10 in region 1 may not be communicatively coupled or otherwise in communication with the deployment 10 in region 2.

[0125] Fig.12 12 is a block diagram 1200 illustrating another example model of an IaaS architecture according to at least one embodiment. A service operator 1202 (e.g., Fig.10 The service operator 1002) can be communicatively coupled to the secure host lease 1204 (e.g., Fig.10 The secure host lease 1204 may include a virtual cloud network (VCN) 1206 (e.g., Fig.10 VCN 1006) and secure host subnet 1208 (e.g., Fig.10 VCN 1206 may include LPG 1210 (e.g., Fig.10 1010), which may be communicatively coupled to the SSH VCN 1212 via the LPG 1210 contained in the SSH VCN 1212 (e.g., Fig.10 SSH VCN 1012). SSH VCN 1212 may include SSH subnet 1214 (e.g., Fig.10 SSH subnet 1014 of the control plane VCN 1216), and SSH VCN 1212 can be communicatively coupled to control plane VCN 1216 via LPG 1210 contained in control plane VCN 1216 (e.g., Fig.101016) and is coupled to the data plane VCN 1218 via the LPG 1210 included in the data plane VCN 1218 (e.g., Fig.10 The control plane VCN 1216 and the data plane VCN 1218 may be included in a service lease 1219 (e.g., Fig.10 Service lease 1019).

[0126] The control plane VCN 1216 may include a load balancer (LB) subnet 1222 (e.g., Fig.10 The control plane DMZ layer 1220 (e.g., Fig.10 The control plane DMZ layer 1020 may include (one or more) application subnets 1226 (e.g., similar to Fig.10 (one or more) application subnets 1026) of the control plane application layer 1224 (e.g., Fig.10 A control plane application layer 1024), a control plane data layer 1228 (eg, Fig.10 The LB subnet(s) 1222 contained in the control plane DMZ layer 1220 may be communicatively coupled to the application subnet(s) 1226 contained in the control plane application layer 1224 and the internet gateway 1234 (e.g., Fig.10 1034), and the application subnet(s) 1226 may be communicatively coupled to the DB subnet(s) 1230 and the service gateway 1236 (e.g., Fig.10 ) and a network address translation (NAT) gateway 1238 (e.g., Fig.10 The control plane VCN 1216 may include a service gateway 1236 and a NAT gateway 1238.

[0127] The data plane VCN 1218 may include a data plane application layer 1246 (e.g., Fig.10 Data plane application layer 1046), data plane DMZ layer 1248 (e.g., Fig.10 The data plane DMZ layer 1048), and the data plane data layer 1250 (e.g., Fig.10The data plane DMZ layer 1248 may include (one or more) trusted application subnets 1260 and (one or more) untrusted application subnets 1262 that may be communicatively coupled to the data plane application layer 1246 and (one or more) LB subnets 1222 of the Internet gateway 1234 included in the data plane VCN 1218. The (one or more) trusted application subnets 1260 may be communicatively coupled to the service gateway 1236 included in the data plane VCN 1218, the NAT gateway 1238 included in the data plane VCN 1218, and (one or more) DB subnets 1230 included in the data plane data layer 1250. The (one or more) untrusted application subnets 1262 may be communicatively coupled to the service gateway 1236 included in the data plane VCN 1218 and (one or more) DB subnets 1230 included in the data plane data layer 1250. Data plane data layer 1250 may include DB subnet(s) 1230 that may be communicatively coupled to a service gateway 1236 included in data plane VCN 1218 .

[0128] Untrusted application subnet(s) 1262 may include one or more primary VNICs 1264(1)-(N) that may be communicatively coupled to tenant virtual machines (VMs) 1266(1)-(N). Each tenant VM 1266(1)-(N) may be communicatively coupled to a respective application subnet 1267(1)-(N) that may be contained in a respective container egress VCN 1268(1)-(N), which may be contained in a respective customer tenancy 1270(1)-(N). Respective secondary VNICs 1272(1)-(N) may facilitate communications between untrusted application subnet(s) 1262 contained in data plane VCN 1218 and application subnets contained in container egress VCNs 1268(1)-(N). Each container egress VCN 1268(1)-(N) may include a NAT gateway 1238 that may be communicatively coupled to the public Internet 1254 (e.g., Fig.10 of the public Internet 1054).

[0129] The Internet gateway 1234 included in the control plane VCN 1216 and included in the data plane VCN 1218 can be communicatively coupled to the metadata management service 1252 (e.g., Fig.101254) can be communicatively coupled to a public Internet 1254. The public Internet 1254 can be communicatively coupled to a NAT gateway 1238 included in the control plane VCN 1216 and included in the data plane VCN 1218. The service gateway 1236 included in the control plane VCN 1216 and included in the data plane VCN 1218 can be communicatively coupled to a cloud service 1256.

[0130] In some embodiments, the data plane VCN 1218 can be integrated with the customer lease 1270. In some cases, such integration may be useful or desirable for the customers of the IaaS provider, such as where support may be desired when executing code. A customer may provide code to run that may be destructive, may communicate with other customer resources, or may otherwise cause undesirable effects. In response to this, the IaaS provider may determine whether to run the code given to the IaaS provider by the customer.

[0131] In some examples, a customer of an IaaS provider may grant temporary network access to the IaaS provider and request functionality attached to a data plane layer application 1246. Code running the functionality may be executed in a VM 1266(1)-(N), and the code may not be configured to run anywhere else on the data plane VCN 1218. Each VM 1266(1)-(N) may be connected to a customer tenancy 1270. The corresponding container 1271(1)-(N) contained in the VM 1266(1)-(N) may be configured to run the code. In this case, there may be double isolation (e.g., the container 1271(1)-(N) runs the code, where the container 1271(1)-(N) may be contained at least in a VM 1266(1)-(N) contained in (one or more) untrusted application subnets 1262), which may help prevent incorrect or otherwise undesirable code from damaging the IaaS provider's network or damaging the network of a different customer. Containers 1271(1)-(N) may be communicatively coupled to customer lease 1270 and may be configured to transmit or receive data from customer lease 1270. Containers 1271(1)-(N) may not be configured to transmit or receive data from any other entity in data plane VCN 1218. After running the code is complete, the IaaS provider may terminate or otherwise dispose of containers 1271(1)-(N).

[0132] In some embodiments, the trusted application subnet(s) 1260 may run code that may be owned or operated by the IaaS provider. In this embodiment, the trusted application subnet(s) 1260 may be communicatively coupled to the DB subnet(s) 1230 and configured to perform CRUD operations in the DB subnet(s) 1230. The untrusted application subnet(s) 1262 may be communicatively coupled to the DB subnet(s) 1230, but in this embodiment, the untrusted application subnet(s) may be configured to perform read operations in the DB subnet(s) 1230. The containers 1271(1)-(N) that may be included in each customer's VM 1266(1)-(N) and that may run code from the customer may not be communicatively coupled to the DB subnet(s) 1230.

[0133] In other embodiments, the control plane VCN 1216 and the data plane VCN 1218 may not be directly communicatively coupled. In this embodiment, there may be no direct communication between the control plane VCN 1216 and the data plane VCN 1218. However, communication may occur indirectly through at least one method. The LPG 1210 may be established by an IaaS provider, which may facilitate communication between the control plane VCN 1216 and the data plane VCN 1218. In another example, the control plane VCN 1216 or the data plane VCN 1218 may call the cloud service 1256 via the service gateway 1236. For example, the call from the control plane VCN 1216 to the cloud service 1256 may include a request for a service that can communicate with the data plane VCN 1218.

[0134] Fig.13 13 is a block diagram 1300 illustrating another example model of an IaaS architecture according to at least one embodiment. A service operator 1302 (e.g., Fig.10 The service operator 1002) can be communicatively coupled to the secure host lease 1304 (e.g., Fig.10 The secure host lease 1004 may include a virtual cloud network (VCN) 1306 (e.g., Fig.10 VCN 1006) and secure host subnet 1308 (e.g., Fig.10 VCN 1306 may include LPG 1310 (e.g., Fig.10 1010), which may be accessed via a SSH VCN 1312 (e.g., Fig.10LPG 1310 in SSH VCN 1012 of the present invention is communicatively coupled to SSH VCN 1312. SSH VCN 1312 may include SSH subnet 1314 (e.g., Fig.10 SSH subnet 1014 of the control plane VCN 1314), and SSH VCN 1312 can be communicatively coupled to control plane VCN 1316 via LPG 1310 contained in control plane VCN 1316 (e.g., Fig.10 The control plane VCN 1016 of FIG. 1014 is coupled to the data plane VCN 1318 via the LPG 1310 included in the data plane VCN 1318 (eg, Fig.10 The control plane VCN 1316 and the data plane VCN 1318 may be included in a service lease 1319 (e.g., Fig.10 Service lease 1019).

[0135] The control plane VCN 1316 may include a LB subnet 1322 (e.g., Fig.10 The control plane DMZ layer 1320 (e.g., Fig.10 The control plane DMZ layer 1020 may include (one or more) application subnets 1326 (e.g., Fig.10 (one or more) application subnets 1026) of the control plane application layer 1324 (e.g., Fig.10 The control plane application layer 1024 of FIG. 1024 may include (one or more) DB subnets 1330 (e.g., Fig.12 (one or more) DB subnets 1230) of the control plane data layer 1328 (e.g., Fig.10 1328). The LB subnet(s) 1322 contained in the control plane DMZ layer 1320 may be communicatively coupled to the application subnet(s) 1326 contained in the control plane application layer 1324 and the internet gateway 1334 (e.g., Fig.10 1034), and the application subnet(s) 1326 may be communicatively coupled to the DB subnet(s) 1330 and the service gateway 1336 (e.g., Fig.10 Serving gateway) and network address translation (NAT) gateway 1338 (e.g., Fig.10 The control plane VCN 1316 may include a service gateway 1336 and a NAT gateway 1338.

[0136] The data plane VCN 1318 may include a data plane application layer 1346 (e.g., Fig.10 Data plane application layer 1046), data plane DMZ layer 1348 (e.g., Fig.10 Data plane DMZ layer 1048)), and data plane data layer 1350 (e.g., Fig.10 The data plane DMZ layer 1348 may include (one or more) LB subnets 1322, which may be communicatively coupled to (one or more) trusted application subnets 1360 (e.g., Fig.12 (one or more) trusted application subnets 1260) and (one or more) untrusted application subnets 1362 (e.g., Fig.12 The trusted application subnet(s) 1360 may be communicatively coupled to the service gateway 1336 contained in the data plane VCN 1318, the NAT gateway 1338 contained in the data plane VCN 1318, and the DB subnet(s) 1330 contained in the data plane data layer 1350. The untrusted application subnet(s) 1362 may be communicatively coupled to the service gateway 1336 contained in the data plane VCN 1318 and the DB subnet(s) 1330 contained in the data plane data layer 1350. The data plane data layer 1350 may include the DB subnet(s) 1330 that may be communicatively coupled to the service gateway 1336 contained in the data plane VCN 1318.

[0137] Untrusted application subnet(s) 1362 may include primary VNICs 1364(1)-(N) that may be communicatively coupled to tenant virtual machines (VMs) 1366(1)-(N) residing within the untrusted application subnet(s) 1362. Each tenant VM 1366(1)-(N) may run code in a corresponding container 1367(1)-(N) and may be communicatively coupled to application subnet 1326 that may be contained in data plane application layer 1346 contained in container egress VCN 1368. Corresponding secondary VNICs 1372(1)-(N) may facilitate communications between untrusted application subnet(s) 1362 contained in data plane VCN 1318 and application subnets contained in container egress VCN 1368. Container egress VCNs may include primary VNICs 1364(1)-(N) that may be communicatively coupled to public Internet 1354 (e.g., Fig.10 NAT gateway 1338 of the public Internet 1054).

[0138] The Internet gateway 1334 included in the control plane VCN 1316 and included in the data plane VCN 1318 can be communicatively coupled to the metadata management service 1352 (e.g., Fig.10 1352), which can be communicatively coupled to the public Internet 1354. The public Internet 1354 can be communicatively coupled to the NAT gateway 1338 included in the control plane VCN 1316 and included in the data plane VCN 1318. The service gateway 1336 included in the control plane VCN 1316 and included in the data plane VCN 1318 can be communicatively coupled to the cloud service 1356.

[0139] In some examples, Fig.13 The architecture model shown in block diagram 1300 can be considered as Fig.12 1200 , and may be desired by customers of the IaaS provider if the IaaS provider cannot communicate directly with the customer (e.g., in a disconnected region). The customer may access the corresponding container 1367(1)-(N) contained in each customer's VM 1366(1)-(N) in real time. The container 1367(1)-(N) may be configured to make calls to the corresponding secondary VNIC 1372(1)-(N) contained in the application subnet(s) 1326 of the data plane application layer 1346, which may be contained in the container egress VCN 1368. The secondary VNIC 1372(1)-(N) may transmit the call to the NAT gateway 1338, which may transmit the call to the public Internet 1354. In this example, containers 1367(1)-(N), which may be accessed by customers in real time, may be isolated from control plane VCN 1316 and may be isolated from other entities contained in data plane VCN 1318. Containers 1367(1)-(N) may also be isolated from resources from other customers.

[0140] In other examples, a customer may use containers 1367(1)-(N) to call cloud service 1356. In this example, a customer may run code in containers 1367(1)-(N) to request a service from cloud service 1356. Containers 1367(1)-(N) may transmit the request to secondary VNICs 1372(1)-(N), which may transmit the request to a NAT gateway, which may transmit the request to public Internet 1354. Public Internet 1354 may transmit the request to LB subnet(s) 1322 contained in control plane VCN 1316 via Internet gateway 1334. In response to determining that the request is valid, LB subnet(s) may transmit the request to application subnet(s) 1326, which may transmit the request to cloud service 1356 via service gateway 1336.

[0141] It should be appreciated that the IaaS architectures 1000, 1100, 1200, 1300 depicted in the various figures may have other components than those depicted. In addition, the embodiments shown in the various figures are merely some examples of cloud infrastructure systems that may be combined with embodiments of the present disclosure. In some other embodiments, the IaaS system may have more or fewer components than shown in the various figures, may combine two or more components, or may have a different configuration or arrangement of components.

[0142] In certain embodiments, the IaaS system described herein may include application suites, middleware, and database service offerings delivered to customers in a self-service, subscription-based, elastically scalable, reliable, highly available, and secure manner. An example of such an IaaS system is Oracle Cloud Infrastructure (OCI) provided by the assignee.

[0143] Fig.14 An example computer system 1400 is illustrated in which various embodiments may be implemented. System 1400 may be used to implement any of the computer systems described above. As shown, computer system 1400 includes a processing unit 1404 that communicates with multiple peripheral subsystems via a bus subsystem 1402. These peripheral subsystems may include a processing acceleration unit 1406, an I / O subsystem 1408, a storage subsystem 1418, and a communication subsystem 1424. Storage subsystem 1418 includes a tangible computer-readable storage medium 1422 and a system memory 1410.

[0144] The bus subsystem 1402 provides a mechanism for allowing the various components and subsystems of the computer system 1400 to communicate with each other by intention. Although the bus subsystem 1402 is schematically shown as a single bus, an alternative embodiment of the bus subsystem can utilize multiple buses. The bus subsystem 1402 can be any of several types of bus structures, including a memory bus or a memory controller, a peripheral bus, and a local bus using any various bus architectures. For example, this architecture can include an industrial standard architecture (ISA) bus, a microchannel architecture (MCA) bus, an enhanced ISA (EISA) bus, a video electronics standard association (VESA) local bus, and a peripheral component interconnect (PCI) bus, which can be implemented as a Mezzanine bus manufactured by the IEEE P1386.1 standard.

[0145] The processing unit 1404, which may be implemented as one or more integrated circuits (e.g., conventional microprocessors or microcontrollers), controls the operation of the computer system 1400. One or more processors may be included in the processing unit 1404. These processors may include single-core or multi-core processors. In certain embodiments, the processing unit 1404 may be implemented as one or more independent processing units 1432 and / or 1434, wherein a single-core or multi-core processor is included in each processing unit. In other embodiments, the processing unit 1404 may also be implemented as a quad-core processing unit formed by integrating two dual-core processors into a single chip.

[0146] In various embodiments, the processing unit 1404 can execute various programs in response to the program code and can maintain multiple concurrently executed programs or processes. At any given time, some or all of the program code to be executed may reside in (one or more) processors 1404 and / or in the storage subsystem 1418. Through appropriate programming, (one or more) processors 1404 can provide the various functions described above. The computer system 1400 can additionally include a processing acceleration unit 1406, which can include a digital signal processor (DSP), a special processor, and the like.

[0147] I / O subsystem 1408 may include user interface input devices and user interface output devices. User interface input devices may include a keyboard, a pointing device such as a mouse or trackball, a touch pad or touch screen incorporated into a display, a scroll wheel, a click wheel, a dial, buttons, switches, a keyboard, an audio input device with a voice command recognition system, a microphone, and other types of input devices. User interface input devices may include, for example, motion sensing and / or gesture recognition devices such as Microsoft Motion sensors that enable users to control apps such as Microsoft 360 game controller. The user interface input device may also include an eye gesture recognition device, such as detecting eye activity from the user (e.g., a "wink" when taking a picture and / or making a menu selection) and translating eye gestures to the input device (e.g., Google ) in Google In addition, the user interface input device may include a user interface that enables the user to communicate with the voice recognition system (e.g., Navigator) interactive voice recognition sensing device.

[0148] The user interface input device may also include, but is not limited to, a three-dimensional (3D) mouse, a joystick or pointing stick, a game panel and a drawing board, and audio / video equipment such as a speaker, a digital camera, a digital video camera, a portable media player, a webcam, an image scanner, a fingerprint scanner, a barcode reader 3D scanner, a 3D printer, a laser rangefinder, and a sight tracking device. In addition, the user interface input device may include, for example, a medical imaging input device such as a computer tomography, a magnetic resonance imaging, a positron emission tomography, a medical ultrasound device. The user interface input device may also include, for example, an audio input device such as a MIDI keyboard, a digital musical instrument, etc.

[0149] The user interface output devices may include a display subsystem, indicator lights, or non-visual displays such as audio output devices, etc. The display subsystem may be a cathode ray tube (CRT), a flat panel device such as using a liquid crystal display (LCD) or plasma display, a projection device, a touch screen, etc. In general, the use of the term "output device" is intended to include all possible types of devices and mechanisms for outputting information from the computer system 1400 to a user or other computers. For example, the user interface output devices may include, but are not limited to, various display devices that visually convey text, graphics, and audio / video information, such as monitors, printers, speakers, headphones, car navigation systems, plotters, voice output devices, and modems.

[0150] Computer system 1400 may include a storage subsystem 1418, including software elements, shown presently located within system memory 1410. System memory 1410 may store program instructions that may be loaded and executed on processing unit 1404, as well as data generated during the execution of these programs.

[0151] Depending on the configuration and type of computer system 1400, system memory 1410 can be volatile (such as random access memory (RAM)) and / or non-volatile (e.g., read-only memory (ROM), flash memory, etc.). RAM generally contains data and / or program services that are immediately accessible and / or currently being operated on and executed by processing unit 1404. In some embodiments, system memory 1410 can include a variety of different types of memory, such as static random access memory (SRAM) or dynamic random access memory (DRAM). In some embodiments, a basic input / output system (BIOS) containing basic routines that help transfer information between elements within computer system 1400 (such as during startup) can generally be stored in ROM. By way of example, but not limitation, system memory 1410 also illustrates application programs 1412, which can include client applications, web browsers, middle-tier applications, relational database management systems (RDBMS), etc., program data 1414, and operating system 1416. By way of example, operating system 1416 can include various versions of Microsoft Apple and / or Linux operating system, various commercially available or UNIX-like operating systems (including but not limited to various GNU / Linux operating systems, Google OS, etc.) and / or mobile operating systems such as iOS, Phone, OS, OS and OS operating system.

[0152] Storage subsystem 1418 may also provide a tangible computer-readable storage medium for storing basic programming and data constructs that provide the functionality of some embodiments. Software (programs, code services, instructions) that provide the above functionality when executed by a processor may be stored in storage subsystem 1418. These software services or instructions may be executed by processing unit 1404. Storage subsystem 1418 may also provide a repository for storing data used in accordance with the present disclosure.

[0153] The storage subsystem 1400 may also include a computer-readable storage media reader 1420, which may be further connected to a computer-readable storage medium 1422. The computer-readable storage medium 1422 may, together with the system memory 1410 and optionally in combination therewith, comprehensively represent remote, local, fixed and / or removable storage devices and storage media for temporarily and / or more permanently containing, storing, transferring and retrieving computer-readable information.

[0154] The computer-readable storage medium 1422 containing the code or portions of the code may also include any suitable media known or used in the art, including storage media and communication media, such as, but not limited to, volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage and / or transmission of information. This may include tangible computer-readable storage media, such as RAM, ROM, electrically erasable programmable ROM (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical storage, cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or other tangible computer-readable media. This may also include non-tangible computer-readable media, such as data signals, data transmissions, or any other media that can be used to transmit the desired information and can be accessed by the computing system 1400.

[0155] By way of example, computer-readable storage media 1422 may include a hard drive that reads from or writes to non-removable nonvolatile magnetic media, a magnetic disk drive that reads from or writes to removable nonvolatile magnetic disks, and a magnetic disk drive that reads from or writes to removable nonvolatile optical disks such as CD ROMs, DVDs, and optical drives. Computer readable storage media 1422 may include, but are not limited to, The computer readable storage medium 1422 may include a solid-state drive (SSD) based on non-volatile memory (such as a flash memory-based SSD, an enterprise flash drive, a solid-state ROM, etc.), a volatile memory-based SSD (such as a solid-state RAM, a dynamic RAM, a static RAM), a DRAM-based SSD, a magnetoresistive RAM (MRAM) SSD, and a hybrid SSD using a combination of DRAM and flash memory-based SSDs. The disk drive and its associated computer-readable media may provide non-volatile storage of computer-readable instructions, data structures, program services, and other data for the computer system 1400.

[0156] The communication subsystem 1424 provides an interface to other computer systems and networks. The communication subsystem 1424 is used as an interface for receiving data from other systems and sending data from the computer system 1400 to other systems. For example, the communication subsystem 1424 can enable the computer system 1400 to be connected to one or more devices via the Internet. In some embodiments, the communication subsystem 1424 may include a radio frequency (RF) transceiver component for accessing a wireless voice and / or data network (e.g., using cellular phone technology, advanced data network technology such as 3G, 4G or EDGE (Enhanced Data Rates for Global Evolution), WiFi (IEEE 802.11 series standards), or other mobile communication technologies, or any combination thereof), a global positioning system (GPS) receiver component and / or other components. In some embodiments, as an addition or replacement of a wireless interface, the communication subsystem 1424 may provide a wired network connection (e.g., Ethernet).

[0157] In some embodiments, the communication subsystem 1424 may also receive incoming communications in the form of structured and / or unstructured data feeds 1426 , event streams 1428 , event updates 1430 , and the like on behalf of one or more users who may use the computer system 1400 .

[0158] For example, the communication subsystem 1424 may be configured to receive data feeds 1426 in real time from users of social networks and / or other communication services, such as feed, Updates, web feeds such as Rich Site Summary (RSS) feeds, and / or real-time updates from one or more third-party information sources.

[0159] Additionally, the communication subsystem 1424 may also be configured to receive data in the form of continuous data streams, which may include event streams 1428 and / or event updates 1430, which may be continuous or unbounded in nature, real-time events without explicit termination. Examples of applications that generate continuous data may include, for example, sensor data applications, financial quote machines, network performance measurement tools (e.g., network monitoring and traffic management applications), clickstream analysis tools, automotive traffic monitoring, and the like.

[0160] The communication subsystem 1424 may also be configured to output structured and / or unstructured data feeds 1426 , event streams 1428 , event updates 1430 , etc. to one or more databases that may be in computer communication with one or more streaming data source computers coupled to the computer system 1400 .

[0161] Computer system 1400 may be one of various types, including a handheld portable device (e.g., Cellular phone, computing tablets, PDAs), wearable devices (e.g. Glass head mounted display), PC, workstation, mainframe, kiosk, server rack, or any other data processing system.

[0162] Due to the ever-changing nature of computers and networks, the description of the computer system 1400 depicted in the figure is only used as a specific example. It is also possible that many other configurations have more or fewer components than the system depicted in the figure. For example, custom hardware can also be used and / or specific elements can be implemented in hardware, firmware, software (including applets) or a combination. In addition, connections with other computing devices (such as network input / output devices) can be adopted. Based on the disclosure and teachings provided herein, those of ordinary skill in the art will recognize other ways and / or methods for implementing various embodiments.

[0163] The embodiments may be implemented by using a computer program product comprising a computer program / instructions which, when executed by a processor, cause the processor to perform any of the methods described in the present disclosure.

[0164] Although specific embodiments have been described, various modifications, variations, alternative constructions, and equivalents are also included within the scope of this disclosure. Embodiments are not limited to operating within certain specific data processing environments, but can be freely operated within multiple data processing environments. In addition, although embodiments have been described using a specific series of transactions and steps, it should be clear to those skilled in the art that the scope of this disclosure is not limited to the described series of transactions and steps. The various features and aspects of the above-described embodiments may be used alone or in combination.

[0165] In addition, although embodiments have been described using specific combinations of hardware and software, it should be appreciated that other combinations of hardware and software are also within the scope of the present disclosure. Embodiments may be implemented using only hardware, or only software, or using a combination thereof. The various processes described herein may be implemented in any combination on the same processor or on different processors. Thus, where a component or service is described as being configured to perform certain operations, such configuration may be accomplished by, for example, designing electronic circuits to perform the operations, by programming programmable electronic circuits (such as microprocessors) to perform the operations, or any combination thereof. Processes may communicate using a variety of techniques, including but not limited to conventional techniques for inter-process communication, and different pairs of processes may use different techniques, or the same pair of processes may use different techniques at different times.

[0166] Thus, the description and drawings are to be regarded as illustrative rather than restrictive. However, it is apparent that additions, subtractions, deletions and other modifications and alterations may be made thereto without departing from the broader spirit and scope set forth in the claims. Therefore, although specific disclosed embodiments have been described, these are not intended to be limiting. Various modifications and equivalent forms are within the scope of the following claims.

[0167] The use of the terms "one" and "an" and "the" and similar references in the context of describing the disclosed embodiments (especially in the context of the following claims) is to be interpreted as covering the singular and the plural, unless otherwise indicated herein or clearly contradicted by the context. Unless otherwise stated, the terms "include", "have", "include" and "contain" are to be interpreted as open terms (i.e., meaning "including but not limited to"). The term "connected" should be interpreted as being partially or completely contained in, attached to or connected together, even if there is something in the middle. Unless otherwise indicated herein, the enumeration of the value range herein is intended only to be used as a shorthand method for individually quoting each individual value falling within the range, and each individual value is incorporated into the specification as if it were individually listed herein. Unless otherwise indicated herein or clearly contradicted by the context, all methods described herein can be performed in any suitable order. The use of any and all examples or exemplary language (e.g., "such as") provided herein is intended only to better illustrate the embodiments and is not intended to limit the scope of the present disclosure, unless otherwise stated. Any language in the specification should not be interpreted as indicating that any unclaimed element is essential to the practice of the present disclosure.

[0168] Disjunctive language, such as the phrase "at least one of X, Y, or Z," unless expressly stated otherwise, is intended to be understood within the context of being generally used to indicate that an item, term, etc. may be X, Y, or Z, or any combination thereof (e.g., X, Y, and / or Z). Thus, such disjunctive language is generally not intended to, and should not, imply that certain embodiments require that at least one of X, at least one of Y, or at least one of Z each be present.

[0169] Preferred embodiments of the present disclosure are described herein, including the best mode known for implementing the present disclosure. Variations of those preferred embodiments will become apparent to those of ordinary skill in the art after reading the above description. Those of ordinary skill should be able to appropriately adopt such variations and may practice the present disclosure in a manner different from that specifically described herein. Thus, the present disclosure includes all modifications and equivalent forms of the subject matter recorded in the appended claims where permitted by applicable law. In addition, unless otherwise indicated herein, the present disclosure includes any combination of the above-mentioned elements in all possible variations thereof.

[0170] All references, including publications, patent applications, and patents, cited herein are hereby incorporated by reference to the same extent as if each reference was individually and specifically indicated to be incorporated by reference and were set forth in its entirety herein.

[0171] In the foregoing description, various aspects of the present disclosure are described with reference to their specific embodiments, but it will be appreciated by those skilled in the art that the present disclosure is not limited thereto. Each feature and aspect disclosed above can be used alone or in combination. In addition, without departing from the broader spirit and scope of this specification, the embodiments can be used in any number of environments and applications other than those described herein. Thus, this specification and the accompanying drawings should be considered illustrative rather than restrictive.

Claims

1. A computer-implemented method comprising: Receiving, by a cloud infrastructure node, a first message that a computing instance may be infected by ransomware; receiving, by the cloud infrastructure node, a security status-based metric associated with the computing instance based at least in part on the first message; comparing, by the cloud infrastructure node, the security status-based metric to the threshold metric; determining, by the cloud infrastructure node, a likelihood of a ransomware attack based at least in part on a comparison of the security state-based metric to a threshold metric; as well as A second message is transmitted, by the cloud infrastructure node to the job scheduler to reschedule the workload for the compute instance based at least in part on the determination.

2. The computer-implemented method of claim 1, wherein the first message is received based at least in part on a detection of a modification to a mapping of a cache location to a memory location.

3. A computer-implemented method as described in any of claims 1 or 2, wherein the first message is received based at least in part on detecting that the computing instance has attempted to transition to a secure state a number of times exceeding a threshold number of times.

4. A computer-implemented method as described in any of claims 1-3, wherein the method further comprises migrating workloads away from the computing instance.

5. A computer-implemented method as described in any of claims 1-4, wherein the security state-based metric is the number of times the processing element invokes an exception level indicating a secure state, the length of time the processing element operates in the secure state, the number of times transitions to the secure state fail or the number of requests to invoke a secure state transition that return an error.

6. The computer-implemented method of any one of claims 1 to 5, wherein the method further comprises: generating a first cryptographic bitmap including a first row of encryption-related data associated with the cache, and generating a second cryptographic bitmap including a second row of encryption-related data associated with the cache; Perform a mathematical exclusive operation on the first and second rows to obtain the increment value; comparing the resulting delta value with a threshold delta value; as well as A determination is made based on the comparison whether the likelihood of a ransomware attack is a false positive.

7. The computer-implemented method of any of claims 1-6, wherein the method further comprises resurfacing computing instances based at least in part on a determination of a likelihood of a ransomware attack.

8. A cloud infrastructure node, comprising: processor; as well as A computer readable medium comprising instructions which, when executed by the processor, cause the processor to: receiving a first message that a computing instance may be infected with ransomware; receiving a security state-based metric associated with the computing instance based at least in part on the first message; comparing the security status based metric to a threshold metric; determining a likelihood of a ransomware attack based at least in part on a comparison of the security state-based metric to a threshold metric; as well as A second message is transmitted to the job scheduler to reschedule the workload for the compute instance based at least in part on the determination.

9. The cloud infrastructure node of claim 8, wherein the first message is received based at least in part on detection of a modification of a mapping of a cache location to a memory location.

10. The cloud infrastructure node of any of claims 8 or 9, wherein the first message is received based at least in part on detecting that the computing instance has attempted to transition to a secure state a number of times exceeding a threshold number of times.

11. The cloud infrastructure node of any one of claims 8-10, wherein the instructions further cause the processor to migrate workload away from the computing instance.

12. A cloud infrastructure node as described in any of claims 8-11, wherein the security state-based metric is the number of times a processing element calls an exception level indicating a security state, the length of time a processing element operates in a secure state, the number of times a transition to a secure state fails or the number of requests to call a secure state transition that return an error.

13. The cloud infrastructure node of any one of claims 8 to 12, wherein the instructions further cause the processor to: generating a first cryptographic bitmap including a first row of encryption-related data associated with the cache, and generating a second cryptographic bitmap including a second row of encryption-related data associated with the cache; Perform a mathematical exclusive operation on the first and second rows to obtain the increment value; comparing the resulting delta value with a threshold delta value; as well as A determination is made based on the comparison whether the likelihood of a ransomware attack is a false positive.

14. The cloud infrastructure node of any of claims 8-13, wherein the instructions further cause the processor to resurface computing instances based at least in part on a determination of a likelihood of a ransomware attack.

15. A non-transitory computer readable medium comprising a sequence of instructions stored thereon, which, when executed by a processor of a cloud infrastructure node, causes the processor to perform operations comprising: receiving a first message that a computing instance may be infected with ransomware; receiving a security state-based metric associated with the computing instance based at least in part on the first message; comparing the security status based metric to a threshold metric; determining a likelihood of a ransomware attack based at least in part on a comparison of the security state-based metric to a threshold metric; as well as A second message is transmitted to the job scheduler to reschedule the workload for the compute instance based at least in part on the determination.

16. The non-transitory computer-readable medium of claim 15, wherein the message is received based at least in part on detection of a modification to a mapping of a cache location to a memory location.

17. The non-transitory computer-readable medium of any of claims 15 or 16, wherein the first message is received based at least in part on detecting that the computing instance has attempted to transition to a secure state a number of times exceeding a threshold number of times.

18. The non-transitory computer-readable medium of any of claims 15-17, wherein the operations further comprise migrating a workload away from a computing instance.

19. The non-transitory computer-readable medium of any one of claims 15-18, wherein the security state-based metric is a number of times the processing element invokes an exception level indicating a secure state, a length of time the processing element operates in a secure state, a number of times transitions to a secure state fail or a number of requests to invoke a secure state transition that return an error.

20. The non-transitory computer readable medium of any one of claims 15-19, wherein the operations further comprise: generating a first cryptographic bitmap including a first row of encryption-related data associated with the cache, and generating a second cryptographic bitmap including a second row of encryption-related data associated with the cache; Perform a mathematical exclusive operation on the first and second rows to obtain the increment value; comparing the resulting delta value with a threshold delta value; as well as A determination is made based on the comparison whether the likelihood of a ransomware attack is a false positive.

Images