Supply chain attack detection

Abstract

To provide a method, apparatus and a computer program for identifying a signed software application comprising a malicious code.SOLUTION: A security server 20 is configured to train an anomalous action detection model 22 by analyzing an action log 24 that stores information collected from actions performed by software applications running on host computers 30 deployed in a plurality of sources 32. The information collected for an instance of the software application is compared to the features so as to classify the instance of the software application as benign or suspicious, and an alert is generated for the instance of the software application only when the instance of the software application is classified as suspicious.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates generally to computer security and networks, and more particularly to detecting anomalous actions performed by a given instance of a software application deployed on multiple host computers across multiple enterprises. [Background technology]

[0002] Many computer and network systems are deployed with multiple layers of security devices and software to detect and repel an ever-increasing range of security threats. At the most basic level, computers use antivirus software to prevent malicious programs from running on the computer. At the network level, intrusion detection and prevention systems analyze and control network traffic to detect and prevent malware from spreading through the network.

[0003] The above description is provided as a general overview of the related art in this field and should not be construed as an admission that any of the information it contains constitutes prior art to the present patent application. Summary of the Invention

[0004] According to one embodiment of the present invention, a method is provided that includes the steps of identifying a plurality of host computers running respective instances of a particular software application, each given instance on each given host computer including a set of program instructions loaded by the host computer from a respective storage device, collecting information from the host computers regarding actions performed by the executing instances, calculating signatures based on the information collected from the plurality of host computers, comparing, by a processor, the collected information about the given instances with the signatures to classify the given instances as benign or suspicious, and generating an alert for the given instance only if the given instance is classified as suspicious.

[0005] In some embodiments, the information includes an action type and an entity.

[0006] In a first information embodiment, the action type of a given action includes creating or injecting a process, and the entity of the given action includes a process having a process name.

[0007] In a second information embodiment, the action type of a given action includes accessing a domain, and the entity of the given action includes a domain name.

[0008] In a third information embodiment, the action type of a given action includes accessing an Internet Protocol (IP) address; The entities for the given action include an IP address.

[0009] In a fourth information embodiment, the action type of a given action includes accessing an Autonomous System Number (ASN) address; The entity for the given action includes an ASN.

[0010] In a fifth information embodiment, the action type of a given action includes loading a shared library, and the entities of the given action include shared libraries having respective names.

[0011] In a sixth information embodiment, the action type of a given action includes accessing a file, and the entity of the given action includes a file having a file name.

[0012] In a seventh information embodiment, the action type of a given action includes accessing a key in a registry, and the entity of the given action includes a registry key having a key name.

[0013] In an eighth information embodiment, the action type of a given action includes transmitting a system call to an operating system, and the entity of the given action includes a system call having a system call name.

[0014] In some embodiments, the host computers include a first host computer distributed among a plurality of sources, and the set of host computers distributed among the sources includes the first host computer and an additional host computer. The method further includes normalizing the entities into canonicalized entities and, for each of the actions, defining a corresponding canonicalized action including a respective action type and a canonicalized entity for one of the actions.

[0015] In an embodiment of the first aspect, the step of calculating a given feature comprises calculating a count of said sources.

[0016] In an embodiment of the second aspect, the step of calculating the given feature includes calculating a count of the sources including at least one host computer in the set that is running a given instance of the software application.

[0017] In an embodiment of the third aspect, for each given action type, the step of calculating a given characteristic includes calculating a count of the host computers in the set that are running a given instance of the software application that performed a given action that includes the given action type.

[0018] In an embodiment of the fourth aspect, for each given action type, the step of calculating a given feature includes calculating a count of the sources, including at least one host computer in the set, that performed a given action that includes the given action type.

[0019] In an embodiment of the fifth aspect, for each given normalization action, the step of calculating a given feature includes calculating a count of the sources, including at least one host computer in the set, that performed the given normalization action.

[0020] In an embodiment of the sixth aspect, the step of calculating the given feature includes calculating a count of distinct normalization actions.

[0021] In an embodiment of the seventh aspect, the step of calculating, for a given source, a given feature includes calculating a first count of distinct normalization actions performed by an instance of the software application running on the host computer at the given source, calculating a respective second count of distinct normalization actions performed by an instance of the software application running on the host computer at each of the sources other than the given source, calculating an average of the second counts, and comparing the first count to the calculated average.

[0022] In an embodiment of the eighth aspect, for each given action type, the step of calculating a given characteristic includes calculating a count of the sources having at least one host computer in the set running a given instance of the software application that performed a given action that includes the given action type.

[0023] In an embodiment of the ninth aspect, for each given normalization action, the step of calculating a given characteristic includes calculating a count of the sources having at least one host computer in the set running a given instance of the software application that performed the given normalization action.

[0024] In an embodiment of the tenth aspect, the step of calculating a given characteristic for each given normalization action includes calculating a count of the host computers in the set running a given instance of the software application that performed the given normalization action.

[0025] In an embodiment of the eleventh aspect, the step of calculating a given characteristic for each given source includes calculating a count of the host computers in the set that are running a given instance of the software application.

[0026] In an embodiment of the twelfth aspect, for each combination including a given source and a given normalization action, the step of calculating a given feature includes calculating a count of the host computers within the given source that performed the given normalization action.

[0027] In an embodiment of the thirteenth aspect, for each combination including a given source and a given action type, the step of calculating a given feature includes calculating a count of the host computers in the given source that performed a given normalization action that included the given action type.

[0028] In an embodiment of the fourteenth aspect, for each source, the step of computing a given feature includes computing a count of different normalization actions performed by the software application running on the host computer belonging to the given source.

[0029] In an embodiment of the fifteenth aspect, for each source, the step of calculating a given characteristic includes calculating a count of the host computers that belong to the given source.

[0030] In one embodiment, the host computer executes multiple software applications having respective names, and the method further includes normalizing the names, wherein the instances of the particular software application include the instances of the software applications having the same normalized name.

[0031] In another embodiment, the step of collecting the information for a given action performed by a given instance on a given host computer includes detecting the given action performed by the given instance by an endpoint agent running on the host computer, extracting the information for the given action by the endpoint agent, communicating the extracted information by the endpoint agent, and receiving the communicated information by the processor.

[0032] According to one embodiment of the present invention, there is also provided an apparatus including a network interface controller (NIC) and one or more processors configured to identify a plurality of host computers running respective instances of a particular software application, each given instance on each given host computer including a set of program instructions loaded by the host computer from a respective storage device, collect information from the host computers via the NIC regarding actions performed by the running instances, calculate signatures based on the information collected from the plurality of host computers, compare the collected information about the given instance with the signatures to classify the given instance as benign or suspicious, and generate an alert for the given instance only if the given instance is classified as suspicious.

[0033] According to one embodiment of the present invention, a computer software product is additionally provided, the product including a non-transitory computer-readable medium having stored thereon program instructions that, when read by a computer, cause the computer to identify multiple host computers running respective instances of a particular software application, each given instance on each given host computer including a set of program instructions loaded by the host computer from a respective storage device, collect information from the host computers via the NIC regarding actions performed by the running instances, calculate signatures based on the information collected from the multiple host computers, compare the collected information about the given instance to the signatures to classify the given instance as benign or suspicious, and generate an alert for the given instance only if the given instance is classified as suspicious. [Brief explanation of the drawings]

[0034] The present disclosure is herein described, by way of example only, with reference to the accompanying drawings. [Figure 1] FIG. 1 is a block diagram that schematically illustrates a security server configured to train and execute models that can be used to detect anomalous actions performed by software applications running on host computers in multiple networks, in accordance with one embodiment of the present invention. [Figure 2] FIG. 2 is a block diagram of exemplary hardware, software, and data components of a given host computer according to one embodiment of the present invention. [Figure 3] FIG. 3 is a block diagram illustrating the hardware and data components of an exemplary security server according to one embodiment of the present invention. [Figure 4]FIG. 4 is a block diagram illustrating exemplary data components that a security server may store in an action log, according to an embodiment of the present invention. [Figure 5] FIG. 5 is a block diagram illustrating an exemplary model according to one embodiment of the present invention. [Figure 6] FIG. 6 is a flow chart that schematically illustrates a method for training a model on a set of training data, according to one embodiment of the present invention. [Figure 7] FIG. 7 is a flow chart that schematically illustrates a method for using a model to classify actions in training data, according to one embodiment of the present invention. [Figure 8] FIG. 8 is a flow chart that schematically illustrates a method for using a model to classify actions performed by a software application in real time, in accordance with one embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0035] One level of security that an enterprise can employ to protect its data is to limit the software applications deployed on the enterprise's network to signed software applications. However, there may be instances in which malicious code is inserted into a given software application before the application is signed. In these instances, a vendor may distribute signed versions of a software application to an enterprise customer that include malicious code that can be used to launch a cyber attack on the given customer. These cyber attacks are sometimes known as supply chain attacks.

[0036]

[0006] Embodiments of the present invention provide a method and system for identifying signed software applications that contain malicious code. As described below, multiple host computers running respective instances of a particular software application are identified, with each given instance on each given host computer including a set of program instructions loaded by the host computer from a respective storage device. Information regarding actions performed by the running instances is collected from the host computers, and signatures are calculated based on the information collected from the multiple host computers. The information collected about a given instance is compared to the signatures to classify the given instance as benign or suspicious, and an alert is generated for the given instance only if the given instance is classified as suspicious.

[0037] Systems implementing embodiments of the present invention can monitor millions of actions performed by dozens of different software applications running on thousands of host computers deployed across hundreds of enterprises. This wealth of information enables these systems to identify anomalous (and therefore suspicious) actions performed by a given instance of a given application, even if the given application is signed.

[0038] System Description 1 is a block diagram that schematically illustrates an exemplary security server configured to train and execute an anomalous action detection model 22 in accordance with one embodiment of the present invention. In the embodiment described below, security server 20 is configured to train model 22 by analyzing action logs 24 that store information collected from actions 26 performed by software applications 28 executing on host computers 30 deployed across multiple sources 32.

[0039] In some embodiments, the set of host computers 30 may include all host computers 30 in all sources 32. For each given software application 28, a first subset may include host computers (i.e., from all sources 32) that are running an instance of each given software application. And each given source 32 may have a second subset of host computers that includes host computers in the given source that are running an instance of each given software application.

[0040] In some embodiments, each given host computer 30 may run a respective instance of an endpoint agent 34 that detects actions 26 performed by software applications 28 running on the given host computer, extracts information from each given detected action 26, and communicates the extracted information about the detected action to the security server 20.

[0041] Each source 32 can be referenced by a respective source identifier (ID) 36 and may include an organization or business having a local data network, such as a local area network (LAN) 38, coupled to a gateway 40 that couples host computers (to each other and) the LAN 38 to a public network, such as the Internet 42.

[0042] In the configuration shown in FIG. 1, the host computer 30 can communicate over the Internet 40 with one or more remote servers 44 (e.g., web servers, CDN servers, etc.), each having attributes such as an Internet Protocol (IP) address 46, a domain (name) 48, and an Autonomous System Number (ASN) 50.

[0043] 2 is a block diagram illustrating exemplary hardware, software, and data components in a given host computer 300 according to one embodiment of the invention. A given host computer may include a host processor 60, host memory 62, storage devices 64, and a host network interface controller (NIC) 66 that couples the given host computer to a respective LAN 38.

[0044] In some embodiments, each host computer 30 may include (or be assigned) a respective host ID 68. Exemplary host IDs include, but are not limited to, a media access control (MAC) address and a local IP address.

[0045] Storage device 64 typically stores a set of files 70. In some embodiments, a given file 70 may include a respective file signature 72 (e.g., a computed hash) and a respective file signature ID 74 that indicates the identity of the entity that generated the respective file signature. Each given file 70 includes a respective file name 76, a respective file size 78, and a respective file type 80. Exemplary file types 80 include, but are not limited to, executable files, shared libraries (e.g., DLLs), documents, images, and ZIP files. TM (i.e., compressed).

[0046] In embodiments herein, a given file 70 having a given type 80 may be referred to by the respective type 80. For example, a given file 70 whose respective type 80 is "executable" may be referred to herein as a given executable file 70. And, a given file 70 whose respective type 80 is "shared library" may be referred to herein as a given DLL file 70.

[0047] In some embodiments, a given endpoint agent 34 running on a given host computer 30 can classify the file type for a given file 70 by analyzing data that the respective host processor reads from or writes to the given file. For example, if the data contains compressed image data, the given endpoint agent can classify the file type as an image file type (e.g., JPG).

[0048] 2, memory 62 includes an operating system 82, management information 84, a registry 86, an endpoint agent 34, and a plurality of processes 88 having respective process names 90. In some embodiments, operating system 82 may include a set of system calls (syscalls) 81 having respective syscall names 83. One example of operating system 82 is WINDOWS®, manufactured by Microsoft Corporation of Redmond, Washington, USA. One example of endpoint agent 34 is CORTEX XDR®, manufactured by Palo Alto Networks, Inc. of 3000 Tanner Way, Santa Clara, California 95054, USA. TM is.

[0049] To manage the operation of a given host computer, processor 60 may execute operating system 82. Registry 86 may include a database of registry keys 92, each having a respective key name 93, that store low-level settings for the operating system. During operation, operating system 82 may access (i.e., read or update) keys 92 to manage a given host computer.

[0050] A given process 88 includes a set of program instructions 94 that can be executed by the processor 100. To begin execution of a given software application 28, the processor 60 can load a given executable file 70 (i.e., a given file 70 whose respective file type 78 is "executable") and begin executing the program instructions 94 as the given process.

[0051] In some embodiments, a given process 88 may include a respective process signature 96 and a respective process signature ID 98 that indicates the identity of the entity that generated the respective process signature.

[0052] Figure 3 is a block diagram illustrating the hardware and data components in an exemplary security server 20, according to one embodiment of the present invention. In the configuration shown in Figure 3, security server 20 includes a server processor 100, a server memory 102 that stores action logs 24 and models 22, and a server NIC 104 that couples the security server to the Internet 42.

[0053] In some embodiments, action log 24 includes a set of log entries 106 and model 22 includes a set of features 108. Log entries 106 are described below in the description with reference to FIG. 4, and features 108 are described below in the description with reference to FIG. 5.

[0054] Processors 60 and 100 include general-purpose central processing units (CPUs) or dedicated embedded processors, which are programmed with software or firmware to perform the functions described herein. This software may be downloaded to host computer 30 or security server 22 in electronic form, for example, over a network. Additionally or alternatively, the software may be stored on a tangible, non-transitory computer-readable medium, such as an optical, magnetic, or electronic memory medium. Further, additionally or alternatively, at least some of the functions of processors 60 and 100 may be performed by hardwired or programmable digital logic circuitry.

[0055] Exemplary memories 62, 102 and storage devices 64 include dynamic random access memory, non-volatile random access memory, hard disk drives, and solid state disk drives.

[0056] In some embodiments, the tasks described herein performed by processors 60 and 90 may be divided among multiple physical and / or virtual computing devices, while in other embodiments, these tasks may be performed in a managed cloud.

[0057] 4 is a block diagram illustrating exemplary data that the processor 100 may store in a given log entry 106, according to an embodiment of the present invention. In an embodiment herein, the log entries 106 have a one-to-one correspondence with the actions 26, and once the processor 100 receives information about a new given action 26 from a given endpoint agent 34 running on a given host computer 39, it may add a new log entry 106 and populate the new log entry with information such as: Host ID 110. In host ID 110, processor 100 may store the host ID 68 of a given host computer. Source ID 112. As mentioned above, a given host computer 30 is deployed to a given source 32. In source ID 112, processor 100 may store the source ID 36 of the given source. • Time 114. In time 114, the processor 100 may store the date and time of a given action. ● Full application name 116. In embodiments in which program instructions 94 of a given software application 28 performed a given action, the processor 100 may store in the full application name 116 the file name 76 of the executable file that stores the program instructions. Normalized Application ID 118. Using the embodiment described below in the description with reference to FIG. 6, the processor 100 can derive a normalized application ID for the full application name 116. Action Types 120. The following are exemplary action types 120 that the processor 100 may store in a new log entry in response to receiving information about a given action: Process Creation. A given software application 28 running on a given host computer has created a new process 88. Domain Access. A given software application running on a given host computer has accessed a given domain 48. IP Address Access. A given software application 28 running on a given host computer has accessed a given IP address 46. ASN Access. A given software application 28 running on a given host computer accessed a given IP address 46 belonging to a given ASN 50. Module Loading. A given software application 28 running on a given host computer loads a shared library, such as a given DLL file 70. Process Injection. A given software application 28 running on a given host computer may inject new processes 88. File Access. A given software application 28 running on a given host computer can create, read from, write to, or delete a given file 70. Registry Access. A given software application 28 running on a given host computer may access a given registry key 92 within the registry 86. Syscalls. A given software application 28 running on a given host computer may communicate a given system call 81 (eg, GetClipboardData) to the operating system 82. Remote Procedure Calls (RPCs). A given software application 28 running on a given host computer may communicate RPCs. Examples of RPCs are described below in the description with reference to FIG. 6. Raw action entity 122. In the raw action entity 122, the processor 100 can store the "entity name" on which a given action was performed by a given software application 28. For example, If the action type 120 is process creation or process injection, the processor 100 may store in the raw action entity 122 the process name of the process created / injected by the given action. If the action type 120 is a domain access, the processor 100 may store in the raw action entity 122 the domain name accessed by the given action. If the action type 120 is an IP address access, the processor 100 may store in the raw action entity 122 the IP address accessed by the given action. If the action type 120 is ASN access, the processor 100 may store in the raw action entity 122 the ASN of the IP address accessed by the given action. If the action type 120 is a module load, the processor 100 may store in the raw action entity 122 the filename of the DLL (ie, shared library) file that was loaded by the given action. If the action type 120 is a file access, the processor 100 may store in the raw action entity 122 the file name of the file accessed by the given action. If the action type 120 is a registry access, the processor 100 may store in the raw action entity 122 the name / identifier of the registry key loaded by the given action. If the action type 120 is a syscall, the processor 100 may store in the raw action entity 122 the syscall name system call invoked by the given action. If the action type 120 is a management system access (e.g., accessing a setting in the operating system 82), the processor 100 can store a query for the setting in the management information 84 in the raw action entity 122. Normalized action entity 124. Using the embodiment described in the description below with reference to FIG. 6, the processor 100 may derive a normalized action entity for the raw action entity 122. A normalization action 126 includes a combination of an action type 120 and a normalization action entity 124 .

[0058] Figure 5 is a block diagram illustrating exemplary data components that a security server may store in a model 22, according to one embodiment of the present invention. In addition to a set of features 108, the model 22 also includes a set of weights 130 that have a one-to-one correspondence with the features. In Figure 5, the features 108 and weights 130 can be distinguished by appending letters to their identification numbers, such that the features include features 108A-108O and the weights include 130A-130O.

[0059] In embodiments herein, the processor 100 calculates, for each given software application 28, features 108 that reflect respective metrics of actions performed by the given software application. ● Features 108 whose respective feature type (not shown) is “global” (these features 108 are referred to herein as global features 108). In some embodiments, the processor 100 can calculate the global features 108 by analyzing all log entries 106. ● Features 108 whose respective feature types include a given source ID 36 (these features 108 are referred to herein as local features 108). In some embodiments, the processor 100 can compute the local features 108 by analyzing log entries 106 whose respective source IDs 112 match the given source ID 36.

[0060] Exemplary global features 108 that the processor 100 can compute based on the log entries 106 include: Feature 108A: The processor 100 may calculate a count of distinct (ie, different) source IDs 112 (ie, with reference to each source 32). ● Feature 108B: For each given normalized application ID 118, the processor 100 may compute a respective feature 108B, where the respective normalized application ID 118 includes a count of distinct sources 32 in the log entries that match the given normalized application ID 118. ●Feature 108C: For each combination including a given normalized application ID 118 and a given normalized action 126, the processor 100 can calculate a respective feature 108C (i.e., with reference to each host computer 30) that includes a count of distinct host IDs 110. Features 108D: For each action type 120, the processor 100 may compute a respective feature 108D that includes a count of distinct source IDs 112. Features 108E: For each normalization action 126, the processor 100 may compute a respective feature 108E that includes a count of distinct source IDs 112. ●Features 108F: For each given normalized application ID 118, the processor 100 may compute a respective feature 108F that includes a count of distinct normalized actions 126 (i.e., those performed by the software application 28 referenced by the given normalized application ID). In some embodiments, the processor 100 may calculate features 108F only for normalization actions 126 performed (i.e., as indicated by log entries 106) by at least a specified number (e.g., five) distinct source IDs 112. ● Features 108G: For each combination including a given normalized application ID 118 and a given action type 120, the processor 100 may compute a respective feature 108G that includes a count of distinct source IDs 112. ● Features 108H: For each combination including a given normalized application ID 118 and a given normalization action 126, the processor 100 may calculate a respective feature 108H that includes a count of distinct source IDs 112. ●Feature 108I: For each combination, including a given combination that includes a given normalized application ID 118 and a given normalized action 126, the processor 100 may calculate a respective feature 108I that includes a count of distinct host IDs 110.

[0061] Exemplary local features 108 that the processor 100 can compute based on the log entries 106 include: ● Features 108J: For each combination including a given distinct source ID 112 and a given normalized application ID 118, the processor 100 may compute a respective feature 108I that includes a count of host IDs 110 (i.e., host computers 30) that include a software application that corresponds to the given normalized application ID. In some embodiments, the processor 100 may include a given host computer 30 in the count only if the given computer has run the software application (i.e., one that corresponds to the given normalized application ID) within a specified period (e.g., the previous 30 days). ●Feature 108K: For each combination including a given distinct source ID 112 and a given normalization action 126, the processor 100 can calculate a respective feature 108J that includes a count of host IDs 110 (i.e., those referring to each host computer 30) that performed the given normalization action. • Features 108L: For each combination of a given distinct source 32 and a given action type 120, the processor 100 may compute a respective feature 108K that includes a count of host IDs 110 that performed the given action type. Features 108M: For each combination including a given distinct source ID 112 and a given normalization application ID 118, the processor 100 may compute a respective feature 108L that includes a count of distinct normalization actions 126. ●Features 108N: For each given distinct source ID 112, the processor 100 may compute a respective feature 108M that includes a count of host IDs 110 (i.e., host computers 30) that belong to (i.e., are deployed in) the given source.

[0062] In addition to the global and local features 108 described above, features 108 may include hybrid (i.e., global / local) features 108O. For each combination including a given distinct source ID 112 and distinct normalization application ID 118 (i.e., one referencing a given software application 28 running on one or more of the host computers at a given source 32), processor 100 may compute a count for each distinct normalization action 126 (i.e., executed by a given software application at a given host computer 30 at a given source). For each given computed count, processor 100 may compute each feature 108O by averaging all computed counts except the given computed count and then comparing the given computed count to the computed average. This may be referred to as “computing the global profiles over the local profiles.” For example, ● Refer to the calculated count as local_distinct_actions. For each distinct normalized application ID 118, the processor 100 calculates: ○AVG(local_distinct_actions) STDDEV(local_distinct_actions) (i.e., for all other source IDs) For each distinct source ID 112, the processor 100 calculates: z-score=(local_distinct_actions)- AVG(local_distinct_actions) / STDDEV(local_distinct_actions) The z-score represents how many standard deviations local_distinct_actions is greater than AVG(local_distinct_actions).

[0063] In features 108A-108 described above, processor 100 performs the counting by counting the number of log entries 106 that match a specified condition. For example, in feature 108N, the specified condition includes a combination of distinct sources and normalized application IDs.

[0064] As will be explained below, the processor 100 can calculate a score for each action based on the features generated for the action. For feature 108C-M, lower values are more suspicious than higher values. For feature 108, lower values are less suspicious than higher values. In some embodiments, the processor 100 may calculate a value between 0 and 1 for each feature 108C-M and 108O, where values closer to 0 are more suspicious and values closer to 1 are less suspicious. Processor 100 may use feature 108B to provide context for features 108C-M and 108O. For example, if feature 108B is in low abundance (e.g., less than 5% of sources), processor 100 may use feature 108B to reduce the suspiciousness of features 108C-M and 108O. Processor 100 can use features 108A and 108N to "normalize" other features 108 (e.g., to the 0-1 range described above). For example, if feature 108D is 700 and feature 108A is 1000, processor 100 can calculate a normalized value for feature 108D as follows: Normalized 108D =700 / 1000 =0.7

[0065] Training and deploying the model 6 is a flow chart that schematically illustrates a method for training a model 22 on a set of training data, according to one embodiment of the present invention. In the embodiment described herein, the training data includes an action log 24.

[0066] In step 140, the processor 100 collects from a plurality of endpoint agents 34, each running on a host computer 30 deployed on a plurality of sources 32, a respective set of actions 26 performed in each raw action entity 122 by a software application running on the host computer.

[0067] In step 142, using the embodiment described above, the processor stores information from the collected actions in respective log entries 106 in the action log 24.

[0068] In step 144, processor 100 normalizes raw entities 122 into normalized entities 124, actions 26 into normalized actions 126, and names 116 of software applications 28 into normalized application IDs 118 in log entries 106. As described above, normalized actions 126 include respective combinations of action types 120 and normalized action entities.

[0069] Different instances of a given software application 28 may have different names 116 that reflect different builds or versions. In a software application normalization embodiment, the processor 100 may normalize the application name 116 by removing unnecessary information to determine a common normalized application ID 118 across all instances. For example, the processor 100 may normalize the full application name 116: Company-App-Agent-x86_64-7.12.0-15.exe Company-App-Agent-x86_64-7.13.0-15.exe Company-App-Agent-x86_64-7.12.0-16.exe Either of the following: companyappagent can be normalized to Then store companyappagent in normalized application ID 118.

[0070] In one embodiment, where the signature for a given software application includes a respective file signature 72, the processor 100 may canonicalize the application name of the given software application by concatenating a vendor name (i.e., the vendor that provided or produced the given software application) with the respective canonicalized application ID 118. In an additional embodiment, the processor 100 may canonicalize the given software application by calculating a hash value for the executable file 70 of the given software application.

[0071] In process normalization embodiments, if a given action type 120 includes a process creation or process injection that includes a new process 88 having a given process name 90, the processor 100 can normalize the process name by removing any unnecessary information in the name. In some embodiments, if a given process includes a respective process signature 96, the processor 100 can normalize the process name by adding the respective process signature ID 98 to the respective normalization entity 124.

[0072] In a domain normalization embodiment, a given action type 120 includes a domain access to a given domain 48. In this embodiment, the processor 100 may divide each domain 48 into three sections. For example, the domain "abcsite.com" may be divided into three sections: ●Public suffix ".com" ●Main domain "site" ●Subdomain "abc" can be divided into

[0073] Because subdomains are often attacker-controlled, the processor 100 can perform this normalization based on the main domain (i.e., "site.com") concatenated with the public suffix.

[0074] In an ASN normalization embodiment, a given action type 120 includes access to a given IP address 46. If the processor 100 can map the given IP address to a given ASN 50 that includes a geolocation, the server processor can normalize the given IP address to the geolocation.

[0075] In a file normalization embodiment, the given action type 120 includes a file access of a given file 70. In one file normalization embodiment, the processor 100 may use the software application embodiment and the process normalization embodiment described above to standardize the given file by removing unnecessary information from the respective file name 76. In other file normalization embodiments, the processor 100 may use the respective file size 80 and / or the respective file type 78 to normalize the given file.

[0076] In an RPC normalization embodiment, a given action type 120 includes an RPC call. For example, WINDOWS TM The operating system uses the WINDOWS MANAGEMENT INSTRUMENTATION TM Use queries: WMI TM Queries are used by both legitimate applications and attackers, and a query can be divided into three sections: SELECT, FROM, and WHERE. Because the WHERE section often contains redundant information, processor 100 can normalize the query by using only the SELECT and FROM sections.

[0077] For example, processor 100 has the following WMI TM This embodiment can be used to normalize queries. SELECT ParentProcessId FROM win32_process WHERE ProcessID='16236 to SELECT ParentProcessId FROM win32_process

[0078] In a registry normalization embodiment, a given action type 120 includes a registry access to a given key 92 having a given path. In one registry normalization embodiment, the processor 100 can normalize the registry access by removing redundant and randomized information in the path.

[0079] Some groups of registry keys 92 tend to be used for malicious activity more frequently than others. In another registry normalization embodiment, processor 100 can assign a respective identifier to each group (i.e., an identifier indicating whether each group is prone to malicious activity) and then use the identifiers for normalization purposes.

[0080] In a syscall normalization embodiment, if a given action type 120 includes a syscall, the processor 100 may normalize the syscall 81 to the syscall name 83 (i.e., without including parameters within the syscall 81).

[0081] Returning to the flowchart, in step 146, using the embodiment described above, processor 100 analyzes action log 24 (here including normalized application ID 118, normalized entity 124, and normalized action 126) to calculate local and global features 108. In the embodiment herein, action log 24 includes information that processor 100 collects from host computer 30 (e.g., host ID 110, source ID 112, time 114, full application name 116, action type 120, and raw action entity 122), as well as information normalized by the server processor (e.g., normalized application name 118, normalized action entity 124, and normalized action 126).

[0082] In step 148, the processor 100 stores the calculated local and global features in the model 22 and the method ends.

[0083] FIG. 7 is a flow chart that schematically illustrates a method for using a model to classify normalized actions 126 in action log 24, according to one embodiment of the present invention.

[0084] In step 150, the processor 100 selects the first log entry 106 in the action log 24. The selected log entry includes the given normalized application ID 118 and the given normalized action 126.

[0085] In step 152, the processor 100 identifies a set of local and global features 108 that the server processor can use to analyze a given normalization action. When analyzing the normalization action 126 in the log entry 106, the processor 100 may use: • One or more first given features 108 (eg, feature 108A) for every normalization action. • One or more second given features 108 (eg, feature 108B) based solely on the given normalized application ID. • One or more third given features 108 (e.g., feature 108L) that are based solely on the given normalization action. • One or more fourth given features 108 (eg, feature 108C) based on a combination of the given normalized application ID and the given normalization action.

[0086] In step 154, processor 100 applies the identified features to the given normalization action to classify the given normalization action as either benign or suspicious. In the following example, processor 100 can calculate a score based on the identified features and determine a classification based on the calculated score. In this example, a score lower than the 0-1 score range is more suspicious, and processor 100 can set a threshold for determining the classification (e.g., a score less than 0.3 can indicate that the given normalization action is suspicious, and a score equal to or greater than 0.3 can indicate that the given normalization action is benign).

[0087] To prevent the score from being affected by insignificant factors (e.g., the number of different sources 32, the number of different host computers 30, and the number of different software applications 28), the processor 100 may normalize each identified feature 108 to normalize the identified feature to the range [0,1]. For example, the processor 100 may perform the following steps: To obtain normalized features (Fi), divide each feature (Fi) (i.e., feature 108) by its “maximum value” (Mi). To scale down large numbers, log both the numerator and denominator. o Truncate the log results to avoid overfitting and bin the data to stabilize the results. Calculate a weighted average of the normalized features to obtain a single score, where each feature has a different weight (Wi) value (i.e., weight 130).

number

number

[0088] In some embodiments, calculating the score allows the processor 100 to compare the action normalization action with the identified features to classify the normalization action as either benign or abnormal, and therefore suspicious.

[0089] If in step 156 the processor 100 classifies the given normalized action as suspicious (i.e., using the embodiments described above), then in step 158 the server processor may generate an alert for the instance of the software application corresponding to the given normalized application ID.

[0090] In step 160, the processor 100 determines whether there are any non-selected log entries 106 in the action log 24. If there are any non-selected log entries 106 in the action log 24, in step 162 the processor 100 selects the next log entry 106 in the action log and the method ends.

[0091] Returning to step 160, if there are no non-selected log entries 106 in the action log 24, the method ends.

[0092] Returning to step 156 , if the processor 100 classifies the given normalization action as benign, the method proceeds to step 162 .

[0093] FIG. 8 is a flow chart that schematically illustrates a method for using a model to perform real-time classification of actions 26, according to one embodiment of the present invention.

[0094] In step 170, the processor 100 receives information of a new action 26 to be performed on a given raw action entity 122 by a given software application 28 from a given endpoint agent 34 running on a given host computer 30.

[0095] In step 172, using the embodiment described above, the processor 100 creates a new log entry 106 and populates the new log entry with the host ID 110, the source ID 112, the time 114, the full application name 116, the normalized application ID 118, the action type 120, the raw action entity 122, the normalized entity 124, and the normalized action 126.

[0096] In step 174, the processor 100 uses the embodiments described above to identify a set of local and global features 108 that the server processor can use to analyze the new normalization action.

[0097] In step 176, the processor 100 uses the embodiments described above to apply the identified features to the new normalized action so as to classify the new normalized action as either benign or suspicious.

[0098] If in step 178 the processor 100 classifies the new normalized action as suspicious, then in step 180 the server processor may generate an alert for the instance of the software application corresponding to the new normalized application ID.

[0099] In step 182, the processor 100 updates the characteristics 108 with the information in the new log entry, and the method ends. In some embodiments, the processor 100 can periodically (e.g., once every 24 hours) update the characteristics 108 with the information in the new log entry 106 (i.e., from a previous update).

[0100] Returning to step 178 , if the processor 100 classifies the new normalized action as benign, the method proceeds to step 182 .

[0101] It will be understood that the above-described embodiments are cited by way of example, and that the present invention is not limited to what has been particularly shown and described above. Rather, the scope of the present invention includes both combinations and subcombinations of the various features described above, as well as variations and modifications thereof which will occur to those skilled in the art upon reading the foregoing description and which are not disclosed in the prior art.

Claims

1. identifying a plurality of host computers running respective instances of a particular software application, each given instance on each given host computer including a set of program instructions loaded by the host computer from a respective storage device; collecting information from the host computer regarding actions performed by the running instance; calculating features based on the information collected from the plurality of host computers; comparing, by a processor, the collected information about a given instance with the characteristics to classify the given instance as benign or suspicious; generating an alert for the given instance only upon classifying the given instance as suspicious; A method comprising:

2. The information includes an action type and an entity. The method of claim 1.

3. the action type of a given action includes creating or injecting a process; the entities of the given action include a process having a process name; The method of claim 2.

4. the action type of a given action includes accessing a domain; the entity for the given action includes a domain name; The method of claim 2.

5. the action type of a given action includes accessing an Internet Protocol (IP) address; the entity for the given action includes an IP address; The method of claim 2.

6. the action type of a given action includes accessing an Autonomous System Number (ASN) address; the entity of the given action includes an ASN; The method of claim 2.

7. the action type of a given action includes loading a shared library; the entities for the given action include a shared library having a respective name; The method of claim 2.

8. the action type of a given action includes accessing a file; the entity of the given action includes a file having a filename; The method of claim 2.

9. the action type of a given action includes accessing a key in a registry; the entity for the given action includes a registry key having a key name; The method of claim 2.

10. the action type of a given action includes transmitting a system call to an operating system; the entities of the given action include a system call having a system call name; The method of claim 2.

11. the host computer executing a plurality of software applications having respective names; and The method further comprises: normalizing the name; the instances of the particular software application include instances of the software applications having the same normalized name; 11. The method according to any one of claims 1 to 10.

12. The step of collecting information for a given action performed by a given instance on a given host computer includes: detecting, by an endpoint agent running on the host computer, the given action performed by the given instance; extracting, by the endpoint agent, the information for the given action; communicating, by the endpoint agent, the extracted information; and receiving, by said processor, said communicated information; 11. The method of claim 1, comprising:

13. 1. An apparatus comprising: A network interface controller (NIC) one or more processors, the processors comprising: identifying a plurality of host computers running respective instances of a particular software application, each given instance on each given host computer including a set of program instructions loaded by said host computer from a respective storage device; collecting information from the host computer via the NIC regarding actions performed by the running instance; Computing characteristics based on the information collected from the plurality of host computers; comparing the collected information about a given instance with the characteristics to classify the given instance as benign or suspicious; and generating an alert for the given instance only upon classifying the given instance as suspicious; It is configured as follows: Device.

14. A computer program comprising computer instructions and stored on a non-transitory computer-readable medium; The computer instructions, when executed by a processor, cause the computer to: identifying a plurality of host computers running respective instances of a particular software application, each given instance on each given host computer including a set of program instructions loaded by said host computer from a respective storage device; collecting information from the host computer via a network interface controller (NIC) regarding actions performed by the running instance; Computing characteristics based on the information collected from the plurality of host computers; comparing the collected information about a given instance with the characteristics to classify the given instance as benign or suspicious; and generating an alert for the given instance only upon classifying the given instance as suspicious; Make it so, Computer program.

15. The information includes an action type and an entity.

15. A computer program according to claim 14.

16. the action type of a given action includes creating or injecting a process; the entities of the given action include a process having a process name; 16. A computer program according to claim 15.

17. the action type of a given action includes accessing a domain; the entity for the given action includes a domain name; 16. A computer program according to claim 15.

18. the action type of a given action includes accessing an Internet Protocol (IP) address; the entity for the given action includes an IP address; 16. A computer program according to claim 15.

19. the host computer executing a plurality of software applications having respective names; and The computer instructions cause the processor to normalize the name; the instances of the particular software application include instances of the software applications having the same normalized name; 19. A computer program according to any one of claims 14 to 18.

20. The step of collecting information for a given action performed by a given instance on a given host computer includes: detecting, by an endpoint agent running on the host computer, the given action performed by the given instance; extracting, by the endpoint agent, the information for the given action; communicating, by the endpoint agent, the extracted information; and receiving, by said processor, said communicated information; 19. A computer program according to any one of claims 14 to 18, comprising:

Images