Real-time monitoring of ransomware attacks using exception-level transition indicators

Abstract

Aspects of the present disclosure include dynamic cloud workload reallocation based on active ransomware attacks. An exemplary method includes receiving a first message that a computing instance may be infected with ransomware. The method further includes receiving an indicator based on a security state associated with the computing instance, at least partially based on the first message. The method further includes comparing the security state-based indicator to a threshold indicator. The method further includes determining a likelihood of a ransomware attack, at least partially based on this comparison. The method further includes sending a second message to a job scheduler and rescheduling the workload directed to the computing instance, at least partially based on this determination.

Description

Technical Field

[0001] Cross - Reference to Related Applications This application claims the benefit of priority of U.S. Non - Provisional Patent Application No. 17 / 743,950, filed on May 13, 2022, the disclosure of which is hereby incorporated by reference in its entirety for all purposes.

[0002] Field This application relates to the field of security monitoring in a network, and more particularly, to real - time monitoring of ransomware attacks using exception - level transition metrics in the aforementioned network.

Background Art

[0003] Background A cloud computing environment includes a combination of a computing infrastructure layer, a cloud platform layer, and an application layer. Each of these layers further includes sub - elements to enable the cloud computing system to provide services to customers. Each of these cloud computing layers and elements may provide an opportunity for malicious actors to break security measures and impair the functionality of the cloud computing environment.

Summary of the Invention

Means for Solving the Problems

[0004] Brief Summary This embodiment relates to the dynamic re - allocation of cloud workloads based on active ransomware attacks. A first example embodiment provides a method executed by a computer for the re - allocation of dynamic workloads. The method can include receiving, by a cloud infrastructure node, a first message that a computing instance may be infected with ransomware.

[0005] A method performed by a computer can further include receiving, by a cloud infrastructure node, an indicator based on a security state associated with a computing instance, at least in part based on a first message.

[0006] A method performed by a computer can further include comparing, by a cloud infrastructure node, an indicator based on a security state to a threshold indicator.

[0007] A method performed by a computer can further include determining, by a cloud infrastructure node, a likelihood of a ransomware attack, at least in part based on this comparison.

[0008] A method performed by a computer can further include sending, by a cloud infrastructure node, a second message to a job scheduler and rescheduling a workload directed to a computing instance, at least in part based on this determination.

[0009] A second embodiment is related to a cloud infrastructure node. The cloud infrastructure node can include a processor and a non-transitory computer-readable medium. The non-transitory computer-readable medium can include instructions that, when executed by the processor, cause the processor to receive a first message that a computing instance may be infected with ransomware.

[0010] These instructions can further cause the processor to receive, at least in part based on the first message, an indicator based on a security state associated with a computing instance.

[0011] These instructions can further cause the processor to compare an indicator based on a security state to a threshold indicator.

[0012] These instructions can further cause the processor to determine the likelihood of a ransomware attack, at least in part based on this comparison.

[0013] These instructions can further cause the processor to send a second message to the job scheduler and reschedule the workload directed to the computing instance, at least in part based on this determination.

[0014] A third embodiment relates to a non-transitory computer-readable medium. The non-transitory computer-readable medium can include a sequence of stored instructions that, when executed by a processor, cause the processor to execute a process. This process can include receiving a first message that there is a possibility that a computing instance is infected with ransomware.

[0015] This process can further include receiving an indicator based on the security state associated with the computing instance, at least in part based on the first message.

[0016] This process can further include comparing the security state-based indicator to a threshold indicator.

[0017] This process can further include determining the likelihood of a ransomware attack, at least in part based on this comparison.

[0018] This process can further include sending a second message to the job scheduler and rescheduling the workload directed to the computing instance, at least in part based on this determination. BRIEF DESCRIPTION OF THE DRAWINGS

[0019]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Best Mode for Carrying Out the Invention

[0020] Detailed Description In the following description, various embodiments will be described. For the purpose of explanation, specific configurations and details are shown so that the embodiments can be fully understood. However, it will also be apparent to those skilled in the art that the embodiments may be practiced without those specific details. Additionally, well-known features may be omitted or simplified in order not to obscure the described embodiments.

[0021] Many cloud computing systems are vulnerable to active security exploits such as ransomware attacks. A ransomware attack can include malicious memory / disk encryption using a private key. Additionally, a ransomware attacker can encrypt client data and hold the data for ransom. Without providing the ransom, the client data may be deleted or inappropriately distributed.

[0022] Ransomware attacks have evolved to the point where many attacks can bypass standard antivirus protection. Furthermore, ransomware may be designed to target specific targets such as the hardware of cloud computing systems. Three examples of ransomware attacks include full disk encryption, Broken Object Level Authorization (BOAL), and a low hammer style of attack. Laptops and servers are particularly vulnerable to these hardware-level ransomware attacks. If a ransomware attack on a laptop or server connected to a cloud environment is successful, the laptop or server may become a gateway for malicious attackers to cause further damage to the cloud system.

[0023] Embodiments of the present disclosure address the above problems by adjusting the detection mechanism to distinguish between temporary encryption / decryption and persistent encryption / decryption, where temporary encryption / decryption is based on legitimate transactions and persistent encryption / decryption indicates a ransomware attack. The detection mechanism can detect a trigger when ransomware infects a cloud computing instance. After the detection mechanism is triggered, the mechanism can collect data related to the security state of the cloud infrastructure node (e.g., secure and non-secure states). The detection mechanism can further determine whether a ransomware attack is likely to have occurred based on the security state data.

[0024] FIG. 1 is a block diagram showing an exemplary system 100 for identifying and mitigating ransomware attacks in a cloud computing infrastructure 102. The system 100 can include a system monitor 104 for detecting and monitoring the encryption / decryption of assembly instructions at the kernel level. The system monitor 104 can detect and monitor encrypted instructions, for example, when an instruction is read from memory into the instruction cache or when an assembly-level instruction is executed. The system monitor 104 can include low-level memory monitoring resources for detecting encryption / decryption instructions. The system monitor 102 can read memory lines to identify any encrypted instructions provided in the memory. Encryption / decryption instructions can be aggregated to determine whether a threshold number of changes are occurring within the memory and to confirm the validity of a ransomware attack in the memory. The system monitor 104 can further monitor the security state of the processing elements (PEs) of the cloud computing infrastructure 102. For example, the system monitor can detect when a PE becomes secure or insecure.

[0025] The system 100 can further include a user space library 106 that includes a set of functions that can initiate monitoring of low-level memory. The user space library 106 can be software that enables communication between the operating system and applications running on the operating system. In some embodiments, the user space library 106 can be multiplexed among libraries at the platform layer of the cloud environment.

[0026] System 100 can further include a memory translator 108. The memory translator 108 can communicate with a memory map to provide cache mapping and unmapping functions to an application. Each time an application is introduced to a cloud computing instance of the cloud, the application provides a set of instructions for communicating with the hardware. The memory translator 108 can direct the application, for example, regarding placement strategies, replacement strategies, and read / write policies of the instructions provided by the application.

[0027] System 100 can communicate with an application 110. The application 110 can include ransomware that maliciously encrypts data within a cloud computing infrastructure.

[0028] Referring to FIG. 2, a repackaging system 200 is shown for migrating computing resources (or, e.g., workloads), erasing memory, and making a request to execute a computing task from an affected computing instance. Repackaging can include restoring the state of the instance to a pre-security-violation state. For example, a repaver 202 can restore the state of a workload if ransomware has been introduced to the workload. The repaver 202 can further migrate the workload from an instance affected by ransomware to an unaffected instance. The repaver 202 can include a host-level repackaging unit 204 for repackaging resources at the host level and a container-level repackaging unit 206 for repackaging resources at the container level. The host-level repackaging unit 204 can include a workload migration unit 208 for repackaging the workload from an affected computing instance at the host level. Further, the host-level repackaging unit 204 can include a reboot host image unit 210 for repackaging the host image of an affected computing instance. The container-level repackaging unit 206 can include a workload migration and pod migration module 212 for repackaging the workload from an affected computing instance.

[0029] Referring to FIG. 3, an exemplary system 300 with the indicated exception levels according to some embodiments is shown. As shown in the figure, system 200 can include a user application 202 operating at exception level 0 204 (ELO: exception level 0), an operating system 206 operating at exception level 1 208 (EL1: exception level one), a hypervisor 210 operating at exception level 2 212 (EL2: exception level two), and a firmware 214 operating at exception level 3 216 (EL3: exception level three). Different applications can be associated with different modules, and each module has different privilege levels of access to system resources or processor resources. As shown in the figure, the exception levels are associated with privilege levels for accessing system resources and processor resources. For example, the operating system 206 operating at EL1 208 can have a higher level of access to system resources and processor resources than the user application 202 operating at EL0 204. For the embodiments described herein, EL can indicate that the privileges of an application are often associated with the current EL. In conventional implementations, a user application can operate with the lowest level of privileges with the most restricted access to system resources and processor resources, an operating system can operate with a medium level of privileges with less restricted access to system resources and processor resources than the lowest level of privileges, and firmware can operate with the highest level of privileges with the least restricted access to system resources and processor resources. It should be understood that the El state is not static and the PE can operate in a first EL state in one example and in a second EL state in another example.

[0030] EL can affect the application's access rights to both memory resources and processor resources. An application can assign attributes, including read / write permissions, to different memory regions. The attributes can be further configured to enable individual access permissions regarding privileged and non-privileged access. For example, when the processor is operating at EL0 and attempts to access memory, the attempt to access can be checked against the non-privileged access permission. However, when the processor is operating at EL1 or above, the attempt to access is checked against the privileged access permission. In addition to memory, access rights to system registers can be based on EL. For example, system registers that hold the configuration of the system can be configured to be accessed based only on EL.

[0031] Referring to FIG. 4, FIG. 400 is shown for explaining the EL, security state, and execution state of a system according to some embodiments. The state of the processor can be determined by the EL and the execution state. The execution state can define the general width of the registers and the available instruction set. The processor architecture can enable the implementation of multiple execution states. The security state can determine which EL is currently active. The processor architecture can further enable the implementation of different security states (e.g., a secure state and a non-secure state). For example, the processor architecture can enable a secure state, and the processor can access secure system registers and non-secure system registers. The processor architecture can enable a non-secure state, and the processor can access a non-secure address space.

[0032] As shown in FIG. 4, elements of a cloud computing system are illustrated to show the EL and security states. As shown in the figure, user application 1 402 in a first execution state, user application 404 in a second execution state, kernel 406 in a second execution state, user application 2 408 in a first execution state, kernel 410 in a first execution state, and the hypervisor are in a non-secure state. The first execution state can be, for example, a 32-bit state, and the second execution state can be, for example, a 64-bit execution state. For the sake of illustration, each element in a non-secure state is shown as a rectangle. Further, as shown in the figure, trusted service 414, trusted operating system 416, and firmware 418 are in a secure state. For the sake of illustration, elements in a secure state are shown as rounded rectangles. Further, as shown in the figure, each element can be further associated with the EL as described with respect to FIG. 3. Each of the elements can access system resources and processor resources based on the execution state, EL, and security state. For example, hypervisor 412 can access a non-secure address space at the EL2 privilege level. On the other hand, firmware 418 can access secure memory at the EL3 privilege level.

[0033] Referring to FIG. 5, a signaling diagram 500 for identifying a ransomware attack according to some embodiments is shown. As shown in the figure, an instruction detector 502, a cloud platform control plane 504, a repayer 506, and a logging service 508 can communicate operably. Although the operations of processes 500, 600, 700, 800, 900, and 1000 are described as being executed by a general-purpose computer, it should be understood that any suitable device (e.g., a user device, a server device) may be used to execute one or more of these processes. Processes 500, 600, 700, 800, 900, and 1000 (described below) are each shown as a logical flow diagram, and each of its operations represents a series of operations that can be implemented in hardware, computer instructions, or a combination thereof. In the context of computer instructions, an operation represents computer-executable instructions stored on one or more computer-readable storage media, and these computer-executable instructions, when executed by one or more processors, perform the listed operations. Typically, computer-executable instructions include routines, programs, objects, components, data structures, etc. that perform a particular function or implement a particular data type. The order in which the operations are described is not intended to be construed as limiting, and any number of the described operations may be combined in any order and / or in parallel to implement the process.

[0034] At 510, the instruction detector 502 can send an indication that a memory encryption trigger has occurred to the cloud platform control plane 504. This transmission can be executed in response to confirming the validity of the instruction as being likely to include a ransomware attack. For example, detecting that a threshold number of changes have occurred between the cache and the memory.

[0035] At 512, the cloud platform control plane 504 can initiate a first workflow. The first workflow can enable the identification of the computing instance that has been victimized and the identification of other computing instances that can be used to take over the workload. For example, the cloud platform control plane 504 can identify the resources available across the infrastructure services. This identification can be based on comparing metrics to key performance indicators (KPIs). These metrics can be collected from and / or based on application profiles, system usage (such as duration, frequency of instance creation, number of user logins, and other disk-level thresholds), and / or these. The KPIs can be based on the security state of one or more PEs. For example, the number of times the processor causes an EL indicates a secure state. For example, in some cases, EL3 indicates a secure state. Thus, when the processor changes from the EL2, EL1, or EL0 state to the EL3 state, this indicates a transition from an insecure state to a secure state. The secure state can then indicate that encryption / decryption is occurring. Another KPI can be the length of time the node operates in a secure state. Yet another KPI can be the number of times the transition to a secure state fails. Yet another KPI can be the number of requests that cause a secure state transition that returns an "overload error".

[0036] In response to not detecting instructions related to encryption, the result can indicate that encryption was not detected. Alternatively, if an instruction to encrypt data is detected, changes in the memory contents for each chunk of the memory line can be calculated. The result can be compared to a threshold to determine whether the instruction exceeds the threshold amount. Further, the result can be processed to determine whether the instruction includes a false detection. In response to verifying a result indicating a high likelihood of a ransomware attack occurring, triggers can be created to repackage an affected computing instance, migrate workloads to unaffected instances, and change the scheduler so as not to schedule workloads on affected instances.

[0037] In some cases, instructions for encrypting and decrypting data can be analyzed to confirm the validity of the result and remove possible false detection cases of identified ransomware attacks via an encryption bitmap. As described above, the user space library can observe the cache over a configurable time frame. For example, the user space library can observe data written to and read from the cache over a three-second time frame. The user space library can further retrieve historical data from the cache over a similar time frame. The historical data functions as a benchmark for the current data, assuming that malicious encryption was not observed at that time. The user space library can compare the two data sets and determine whether the difference (delta) between the two data sets suggests that malicious encryption has occurred.

[0038] In some embodiments, the encrypted bitmap can be generated to include a bitmap of instructions identified for each memory row. A mathematical exclusive OR (XOR) operation can be performed on the bitmaps of adjacent memory rows. As a result of the XOR operation for each set of adjacent bitmaps, a difference value can be derived, and by summing the difference values, a total difference value can be derived. If the total sum of the summed difference values exceeds a threshold, encryption / decryption can be identified. Alternatively, the system can continue to accumulate the instructions identified within the memory set. In some cases, data analysis functions such as minimum, maximum, standard, deviation, etc. can be used to arrive at a possible threshold variation.

[0039] At 514, the cloud platform control plane 504 can send a notification to the cloud repaver mechanism 506 to migrate available resources to different nodes / pods. This notification can identify the affected resources and request that the workload be migrated to the identified resources.

[0040] At 516, the cloud platform control plane 504 can send an instruction to the repaver 506 to update the scheduler. This scheduler can exclude the affected pod / node / computing instance from obtaining / executing the corresponding workload.

[0041] At 518, the cloud platform control plane 504 can send a response of the cloud control plane to the ransomware instruction detector 502. This response can be sent in response to updating the scheduler and migrating resources.

[0042] At 520, the instruction detector 502 can update the encrypted KPI. This update can be performed in response to the successful reception of the response from the cloud control plane at 518. Updating the encrypted KPI can include updating the memory map using the memory type, encryption type, and address range / bucket.

[0043] At 522, the instruction detector 502 can send an error message to the logging service 508. This error message can be sent when a failure occurs in the update of the bitmap.

[0044] At 524, the instruction detector 502 can send the status of whether the memory has been swept to the cloud platform control plane 504.

[0045] At 526, a second workflow is started at the cloud platform control plane 504. The second workflow can include state transitions and database updates.

[0046] At 528, if the memory sweep is not complete, the cloud platform control plane 504 can send a notification to the cloud repaver mechanism 506 to continue the repaver schedule. The continuation of the same schedule can be done using the same set of repaver nodes and the same repaver algorithm.

[0047] In some embodiments, randomness and statistical profiling of memory zones can be introduced to identify malicious encryption. The memory can be provided in various zones, such as a cache or main memory. The cache can be further subdivided into cache levels, such as level 1 cache, level 2 cache, and level 3 cache. In some embodiments, the level 1 cache can further include an instruction cache and a data cache. Ransomware can be configured to infect specific memory, such as a data cache or level 2 cache. Further, during a ransomware attack, the respective percentage of data in different caches that is maliciously encrypted is different for each cache. Therefore, to introduce a baseline for the cache (e.g., instruction cache, data cache, level 2 cache), the cache is statistically profiled and sampled.

[0048] The embodiments described herein can employ various statistical profiling techniques for each of the caches. For example, the embodiments described herein can employ a statistical profiling extension (SPE) technique. The processor can use the SPE to select from a group of operations being executed in the processor pipeline. These operations can be, for example, architectural instructions or micro-operations and can be traced along the processor pipeline. The processor can further implement a sampling interval for collecting data. Each time a sample is collected according to this interval, the data is stored in a memory buffer. Each instance where the buffer is full serves as an instruction for software to process the data.

[0049] Statistical profiling enables a non-invasive method for sampling software and hardware using each randomized sampling of the cache. This sampling can be of architectural instructions defined by the instruction set architecture or micro-architecture operations. In some cases, the processor is sampling a multi-threaded process. In such cases, a sampling interval is determined for each thread being profiled. The sampled data can be further compared to a threshold (e.g., a threshold based on a KPI).

[0050] In some embodiments, the methods described herein can be applied to various encryption / decryption categories. For example, these methods can be applied to single encryption and decryption, multiple encryption and decryption, cache encryption including encryption of instruction caches and data caches, and related encryption failures.

[0051] In some embodiments, different encryption categories can be associated with different thresholds for identifying ransomware attacks. In other words, different KPIs such as KPIs based on security status are established based on the encryption category. For example, a weighted average threshold can be applied to single and multiple encryption and decryption. For each identified encryption and decryption, an exponential mathematical equation can be applied. The calculation of this equation can result in a cumulative sum of floating-point numbers. The calculation of this score can also be performed during temporary encryption and decryption recovered at a low level of software / hardware. After these floating-point numbers are averaged, the next processes 600 and 700 can be performed.

[0052] Referring to FIG. 6, a process 600 for identifying ransomware according to some embodiments is shown. As shown in the figure, the KPI manager 602, the user space library 604, the repaver 606, and the logging service 608 can communicate. At 610, the KPI manager 602 can register callbacks and notifications from the user space library 604. This registration can relate to the instruction cache, data cache, entire DRAM, and other memory computing instances of interest. Further, during workload operations, security state information can be mapped to respective host instances, number of threads, and workload profiles. This mapping can be replicated across a cloud computing environment, and the validity of threads can be verified for malicious encryption and legitimate encryption cases.

[0053] At 612, the KPI manager 602 can install a driver using a low-level kernel (e.g., kernel image). This installation can include registering a memory device (e.g., cache, DRAM) for monitoring. Thereby, a communication channel can be established, or the communication channel can be paused until a trigger event occurs.

[0054] At 614, the KPI manager 602 can send a notification to the user space library 604 to maintain a session of the detection mechanism. The user space library 604 can be a set of functions configured for ransomware detection. The user space library 604 can include an update notification, or a scan for changes in the configuration of the detection mechanism. The user space library 604 can further include a confirmation response that the driver is installed using a low-level kernel.

[0055] At 616, the KPI manager 602 can calculate one or more scores. The scores can include a single encryption score, multiple encryption scores, and scores based on encryption categories and positions such as scores for instruction caches and data caches. The scores can vary based on the difference between the number of encryptions and the number of decryptions. This variation can include comparing the score to a previously calibrated score (e.g., a threshold score based on KPIs). In some cases, as the difference in encryption increases over time (e.g., more encryption instructions are identified than decryption instructions), a multiplier can be assigned to the score.

[0056] At 618, the KPI manager 602 can update the cloud scheduler to the cloud repaver mechanism 606. Updating the cloud scheduler can include excluding pods, nodes, or compute instances if a ransomware indication is detected based on a comparison of scores.

[0057] At 620, the KPI manager 602 can send a response from the cloud control plane indicating success to the user space library 604 when the encryption bitmap is successfully updated.

[0058] At 622, the user space library 604 can update KPIs related to the security state. This update can be performed in response to the successful reception of the cloud control plane response 620. Updating the encryption KPIs can include updating the memory map using the type of memory, type of encryption, and address range / bucket.

[0059] At 624, the user space library 604 can send an error message to the logging service 608 if the update of the encryption bitmap fails. This error message can be sent in response to the failure of the update of the encryption bitmap.

[0060] At 626, the user space library 604 can provide the KPI manager 602 with the status of whether the memory has been swept.

[0061] At 628, the KPI manager 602 can start a second workflow. The second workflow can include identifying a security state transition and updating a database.

[0062] At 630, if the memory sweep is not complete, the KPI manager 602 can send a message to the cloud repaver 806 to continue the repaver schedule. The continuation of the same schedule can be done using the same set of repaver nodes and the same repaver algorithm.

[0063] Referring to FIG. 7, a signaling diagram 700 for identifying a ransomware attack according to some embodiments is shown. At 710, the user space detector 702 can send an indication that a memory encryption trigger has occurred to the cloud platform control plane 704. The cloud platform control plane 704 can be a node within the cloud computing system. This transmission can be executed in response to verifying the validity of the instruction as being likely to include a ransomware attack. For example, it is determined that the number of transitions to a secure state exceeds a threshold number.

[0064] At 712, the cloud platform control plane 704 can initiate a first workflow. The first workflow can enable the identification of the computing instance that has been victimized and the identification of other computing instances that can be used to take over the workload. For example, the cloud platform control plane 704 can identify the resources available across the CI service. This identification can be based on comparing metrics to KPIs based on the security state, as described above. In some embodiments, the cloud platform control plane 704 can identify false positives as described above.

[0065] At 714, the cloud platform control plane 704 can send a notification to the repaver 706 to migrate the available resources to different nodes / pods. This notification can identify the victimized resources and request that the workload be migrated to the identified resources.

[0066] At 716, the cloud platform control plane 704 can send an instruction to the repaver 706 to update the scheduler. This scheduler can exclude the victimized pod / node / computing instance from obtaining / running the corresponding workload.

[0067] At 718, the cloud platform control plane 704 can send a response of the cloud platform control plane to the user space detector 702. This response can be sent in response to updating the scheduler and migrating the resources.

[0068] At 720, the user space detector 702 can update the encrypted KPI. This update can be performed in response to the successful receipt of the response from the cloud control plane at 718. Updating the encrypted KPI can include updating the memory map using the type of memory, the type of encryption, and the address range / bucket.

[0069] At 722, the user space detector 702 can send an error message to the logging service 708. This error message can be sent if a failure occurs in the update of the bitmap.

[0070] At 724, the user space detector 702 can send the status of whether the memory has been swept to the cloud platform control plane 704.

[0071] At 726, a second workflow is started at the cloud platform control plane 704. The second workflow can include state transitions and database updates.

[0072] At 728, the cloud platform control plane 704 can send a notification to the repaver 506 to continue the repaver schedule if the memory sweep is not complete. The continuation of the same schedule can be performed using the same set of repaver nodes and the same repaver algorithm.

[0073] Figure 8 shows a process 800 for identifying a ransomware attack according to some embodiments. At 802, the computing device can receive an indication that the computing instance is infected with ransomware. This indication can be based on, for example, a change in the memory mapping from the cache to the system memory. This indication can also be based on the number of attempted transitions from an insecure state to a secure state.

[0074] At 804, the computing device can receive an indicator related to the security state. This indicator can be collected from another entity and based on an application profile, system usage (e.g., period, frequency of instance creation, number of times a user logs on, and other disk-level thresholds). The indicator can include, for example, the number of times the processor causes an EL indicating a secure state. Another indicator can be the length of time the computing instance has operated in a secure state. Yet another indicator can be the number of times the transition to a secure state has failed. Still another indicator can be the number of requests that cause a transition to a secure state and return an "excessive request error".

[0075] At 806, the computing device can compare the collected indicator with a KPI-based threshold. At 808, if the computing device detects ransomware based on this comparison, process 800 proceeds to 810.

[0076] At 810, the computing device can notify the job scheduler to route future jobs away from the affected computing instance.

[0077] However, if the computing device does not detect ransomware, process 800 proceeds to 812. At 812, the computing device does not send a notification to the job scheduler to route future jobs away from the computing instance. FIG. 9 is a process flow 900 for identifying ransomware according to one or more embodiments. At 902, the method can include the computing system receiving a first message that a computing instance may be infected with ransomware.

[0078] At 904, the method can include a computing system receiving an indicator based on a security state associated with a computing instance, at least in part based on a first message.

[0079] At 906, the method can include a computing device comparing an indicator based on a security state to a threshold indicator.

[0080] At 908, the method can include a computing system determining a likelihood of a ransomware attack, at least in part based on a comparison of an indicator based on a security state to a threshold indicator.

[0081] At 910, the method can include a computing system sending a second message to a job scheduler to reschedule a workload directed to a computing instance.

[0082] As described above, infrastructure as a service (IaaS) is a specific type of cloud computing. IaaS can be configured to provide virtualized computing resources via a public network (e.g., the Internet). In the IaaS model, a cloud computing provider can host infrastructure components (e.g., servers, storage devices, network nodes (e.g., hardware), deployment software, platform virtualization (e.g., hypervisor layer), etc.). In some cases, the IaaS provider may provide various services that arise in connection with those infrastructure components (examples of services include billing software, monitoring software, logging software, load balancing software, clustering software, etc.). Therefore, since these services can be policy-driven, IaaS users may be able to implement policies to drive load balancing and maintain application availability and performance.

[0083] In some cases, IaaS customers may access resources and services via a wide area network (WAN) such as the Internet and use the cloud provider's services to install the remaining elements of the application stack. For example, a user can log in to the IaaS platform, create virtual machines (VMs), install an operating system (OS) on each VM, deploy middleware such as a database, create storage buckets for workloads and backups, and install enterprise software on the VM. The customer can then use the provider's services to perform various functions, including balancing network traffic, troubleshooting application problems, monitoring performance, managing disaster recovery, etc.

[0084] In most cases, cloud computing models require the participation of a cloud provider. The cloud provider may be a third-party service that specializes in providing (e.g., offering, lending, selling) IaaS, but this is not necessary. An entity may choose to deploy a private cloud and become its own provider of infrastructure services.

[0085] In some examples, the deployment of IaaS is the process of placing a new application or a new version of an application on a prepared application server, etc. This process may include the process of preparing the server (e.g., installing libraries, daemons, etc.). This process is often managed by a cloud provider under a hypervisor layer (e.g., servers, storage, network hardware, and virtualization). Thus, a customer may be responsible for handling the deployment of (OS), middleware, and / or applications, etc. on top of (e.g., self-service virtual machines that can be spun up on demand).

[0086] In some examples, the provisioning of IaaS may also refer to obtaining computers or virtual hosts for use and installing the required libraries or services on those computers or virtual hosts. In most cases, deployment does not include provisioning, and provisioning may need to be performed first.

[0087] In some cases, there are two different challenges in IaaS provisioning. First, there is the initial challenge of provisioning an initial set of infrastructure before anything is executed. Second, after everything is provisioned, there is the challenge of evolving the existing infrastructure (e.g., adding new services, changing services, removing services, etc.). In some cases, these two challenges may be addressed by enabling the infrastructure configuration to be defined declaratively. In other words, the infrastructure (e.g., which components are required and how those components exchange information) can be defined by one or more configuration files. In this way, the entire infrastructure topology (e.g., which resources depend on which resources and how each of those resources cooperate) can be described declaratively. In some cases, after the topology is defined, a workflow for creating and / or managing the various components described in the configuration file can be generated.

[0088] In some examples, the infrastructure may include many interconnected elements. For example, there may be one or more virtual private clouds (VPCs), also known as core networks (e.g., a configurable and / or shared pool of computing resources, possibly on-demand). In some examples, there may be one or more inbound traffic / outbound traffic group rules provisioned to define how inbound and / or outbound network traffic is configured, and one or more virtual machines (VMs). Other infrastructure elements such as load balancers, databases, etc. may be provisioned. As more infrastructure elements are desired and / or added, the infrastructure can evolve gradually.

[0089] In some cases, continuous deployment techniques may be employed to enable the deployment of infrastructure code across various virtual computing environments. Further, the techniques described can enable infrastructure management within these environments. In some examples, a service team may write code that is desirably deployed to one or more, but in many cases a number of, different production environments (e.g., across various geographical locations, sometimes worldwide). However, in some examples, the infrastructure to which the code is deployed must first be provisioned. In some cases, provisioning can be done manually, provisioning tools may be utilized to provision resources, and / or deployment tools may be utilized to deploy the code after the infrastructure has been provisioned.

[0090] FIG. 10 is a block diagram 1000 showing an exemplary pattern of an IaaS architecture according to at least one embodiment. A service operator 1002 can be communicatively coupled to a secure host tenancy 1004 that can include a virtual cloud network (VCN) 1006 and a secure host subnet 1008. In some examples, the service operator 1702 may use one or more client computing devices, which can be portable handheld devices (e.g., iPhone®, mobile phone, iPad®, computing tablet, personal digital assistant (PDA)) or wearable devices (e.g., Google Glass® head-mounted display) that run software such as Microsoft Windows Mobile®, and / or various mobile operating systems such as iOS, Windows Phone, Android, BlackBerry 8, Palm OS, and have Internet, email, short message service (SMS), BlackBerry®, or other communication protocols enabled. Alternatively, the client computing device can be a general-purpose personal computer, including, for example, personal computers and / or laptop computers running various versions of Microsoft Windows®, Apple Macintosh®, and / or Linux® operating systems. The client computing device can be a workstation computer running any of various commercially available UNIX® or UNIX-like operating systems, including, but not limited to, various GNU / Linux operating systems such as Google Chrome OS.Alternatively or in addition, the client computing device can be any other electronic device, such as a thin client computer, an Internet-enabled gaming system (e.g., a Microsoft Xbox gaming console with or without a Kinect® gesture input device), and / or a personal messaging device, that can communicate via a network and / or the Internet that has access to the VCN 1006.

[0091] The VCN 1006 can include an LPG 1010 that can be communicatively coupled to an SSH VCN 1012 via a local peering gateway (LPG) 1010 included in a secure shell (SSH) VCN 1012. The SSH VCN 1012 can include an SSH subnet 1014 and can be communicatively coupled to a control plane VCN 1016 via an LPG 1010 included in the control plane VCN 1016. Also, the SSH VCN 1012 can be communicatively coupled to a data plane VCN 1018 via the LPG 1010. The control plane VCN 1016 and the data plane VCN 1018 can be included in a service tenancy 1019 that can be owned and / or operated by an IaaS provider.

[0092] The control plane VCN1016 can include a control plane demilitarized zone (DMZ) layer 1020 that functions as a border network (e.g., a part of a corporate network between a corporate intranet and an external network). Servers based on the DMZ can have limited responsibilities and can help keep intrusions contained. Further, the DMZ layer 1020 can include one or more load balancer (LB) subnets 1022, a control plane application layer 1024 that can include an application subnet 1026, and a control plane data layer 1028 that can include a database (DB) subnet 1030 (e.g., a front-end DB subnet and / or a back-end DB subnet). The LB subnet 1022 included in the control plane DMZ layer 1020 can be communicatively coupled to the application subnet 1026 included in the control plane application layer 1024 that can be included in the control plane VCN1016 and to the Internet gateway 1034, and the application subnet 1026 can be communicatively coupled to the DB subnet 1030 included in the control plane data layer 1028 as well as to the service gateway 1036 and the network address translation (NAT) gateway 1038. The control plane VCN1016 can include the service gateway 1036 and the NAT gateway 1038.

[0093] The control plane VCN 1016 can include a data plane mirror app layer 1040 that can include an app subnet 1026. The app subnet 1026 included in the data plane mirror app layer 1040 can include a virtual network interface controller (VNIC) 1042 that can execute a compute instance 1044. The compute instance 1044 can communicatively couple the app subnet 1026 of the data plane mirror app layer 1040 to the app subnet 1026 that can be included in the data plane app layer 1046.

[0094] The data plane VCN 1018 can include a data plane app layer 1046, a data plane DMZ layer 1048, and a data plane data layer 1050. The data plane DMZ layer 1048 can include an LB subnet 1022 that can be communicatively coupled to the app subnet 1026 of the data plane app layer 1046 and the internet gateway 1034 of the data plane VCN 1018. The app subnet 1026 can be communicatively coupled to the service gateway 1036 and the NAT gateway 1038 of the data plane VCN 1018. The data plane data layer 1050 can also include a DB subnet 1030 that can be communicatively coupled to the app subnet 1026 of the data plane app layer 1046.

[0095] The internet gateways 1034 of the control plane VCN 1016 and the data plane VCN 1018 can be communicatively coupled to a metadata management service 1052 that can be communicatively coupled to the public internet 1054. The public internet 1054 can be communicatively coupled to the NAT gateways 1038 of the control plane VCN 1016 and the data plane VCN 1018. The service gateways 1036 of the control plane VCN 1016 and the data plane VCN 1018 can be communicatively coupled to cloud services 1056.

[0096] In some examples, the service gateway 1036 of the control plane VCN 1016 or the data plane VCN 1018 can make application programming interface (API) calls to the cloud service 1056 without going through the public Internet 1054. The API calls from the service gateway 1036 to the cloud service 1056 can be one-way, and the service gateway 1036 can make API calls to the cloud service 1056, and the cloud service 1056 can send the requested data to the service gateway 1036. However, the cloud service 1056 does not need to initiate an API call to the service gateway 1036.

[0097] In some examples, the secure host tenancy 1004 can be directly connected to the service tenancy 1019, or otherwise separated. The secure host subnet 1008 can communicate with the SSH subnet 1014 via the LPG 1010, and the LPG 1010 can enable two-way communication on a separated system if not. Connecting the secure host subnet 1008 to the SSH subnet 1014 may give the secure host subnet 1008 access to other entities within the service tenancy 1019.

[0098] The control plane VCN 1016 may enable a user of the service tenancy 1019 to set or otherwise provision desired resources. Desired resources provisioned within the control plane VCN 1016 may be deployed or otherwise used in the data plane VCN 1018. In some examples, the control plane VCN 1016 may be separable from the data plane VCN 1018, and the data plane mirror app layer 1040 of the control plane VCN 1016 may communicate with the data plane app layer 1046 of the data plane VCN 1018 via VNICs 1042 that may be included in the data plane mirror app layer 1040 and the data plane app layer 1046.

[0099] In some examples, a user or customer of the system may perform requests, such as create, read, update, or delete (CRUD) operations, via the public internet 1054 that can communicate requests to the metadata management service 1052. The metadata management service 1052 may communicate requests to the control plane VCN 1016 via the internet gateway 1034. The requests may be received by the LB subnet 1022 included in the control plane DMZ layer 1020. The LB subnet 1022 may determine that the requests are valid, and in response, the LB subnet 1022 may send the requests to the app subnet 1026 included in the control plane app layer 1024. If the validity of the requests is confirmed and the requests require calls to the public internet 1054, the calls to the public internet 1054 may be sent to the NAT gateway 1038 that can make calls to the public internet 1054. Metadata that may desirably be stored by the requests may be stored within the DB subnet 1030.

[0100] In some examples, the data plane mirror application layer 1040 can facilitate direct communication between the control plane VCN 1016 and the data plane VCN 1018. For example, it may be desirable for changes, updates, or other appropriate modifications to the configuration to be applied to the resources included in the data plane VCN 1018. Through the VNIC 1042, the control plane VCN 1016 can communicate directly with the resources included in the data plane VCN 1018, thereby enabling changes, updates, or other appropriate modifications to the configuration of the resources.

[0101] In some embodiments, the control plane VCN 1016 and the data plane VCN 1018 may be included in the service tenant 1019. In this case, the user or customer of the system does not have to own or operate either the control plane VCN 1016 or the data plane VCN 1018. Instead, the IaaS provider may own or operate both the control plane VCN 1016 and the data plane VCN 1018, which may both be included in the service tenancy 1019. This embodiment can enable network isolation that can prevent a user or customer from exchanging information with the resources of other users or other customers. Also, this embodiment can allow the user or customer of the system to privately store a database without having to rely on the public Internet 1054, which may not have the desired level of threat prevention for storage.

[0102] In other embodiments, the LB subnet 1022 included in the control plane VCN 1016 may be configured to receive signals from the service gateway 1036. In this embodiment, the control plane VCN 1016 and the data plane VCN 1018 may be configured to be invoked by a customer of the IaaS provider without invoking the public Internet 1054. A customer of the IaaS provider may desire this embodiment because the databases used by the customer may be controlled by the IaaS provider and may be stored in a service tenancy 1019 that can be isolated from the public Internet 1054.

[0103] FIG. 11 is a block diagram 1100 showing another exemplary pattern of an IaaS architecture according to at least one embodiment. A service operator 1102 (e.g., the service operator 1002 of FIG. 10) can be communicatively coupled to a secure host tenancy 1104 (e.g., the secure host tenancy 1004 of FIG. 10) that can include a virtual cloud network (VCN) 1106 (e.g., the VCN 1006 of FIG. 10) and a secure host subnet 1108 (e.g., the secure host subnet 1008 of FIG. 10). The VCN 1106 can be communicatively coupled to a Secure Shell (SSH) VCN 1112 (e.g., the SSH VCN 1012 of FIG. 10) via a local peering gateway (LPG) 1110 (e.g., the LPG 1010 of FIG. 10) included in the SSH VCN 1112. The SSH VCN 1112 can include an SSH subnet 1114 (e.g., the SSH subnet 1014 of FIG. 10), and the SSH VCN 1112 can be communicatively coupled to a control plane VCN 1116 (e.g., the control plane VCN 1016 of FIG. 10) via the LPG 1110 included in the control plane VCN 1116. The control plane VCN 1116 can be included in a service tenancy 1119 (e.g., the service tenancy 1019 of FIG. 10), and a data plane VCN 1118 (e.g., the data plane VCN 1018 of FIG. 10) can be included in a customer tenancy 1121 that can be owned or operated by a user or customer of the system.

[0104] The control plane VCN 1116 can include a control plane DMZ layer 1120 (e.g., the control plane DMZ layer 1020 in FIG. 10) that can include an LB subnet 1122 (e.g., the LB subnet 1022 in FIG. 10), a control plane application layer 1124 (e.g., the control plane application layer 1024 in FIG. 10) that can include an application subnet 1126 (e.g., the application subnet 1026 in FIG. 10), and a control plane data layer 1128 (e.g., the control plane data layer 1028 in FIG. 10) that can include a database (DB) subnet 1130 (e.g., similar to the DB subnet 1030 in FIG. 10). The LB subnet 1122 included in the control plane DMZ layer 1120 can be communicatively coupled to the application subnet 1126 included in the control plane application layer 1124 that can be included in the control plane VCN 1116, and an Internet gateway 1134 (e.g., the Internet gateway 1034 in FIG. 10), and the application subnet 1126 can be communicatively coupled to the DB subnet 1130 included in the control plane data layer 1128, as well as a service gateway 1136 (e.g., the service gateway 1036 in FIG. 10) and a network address translation (NAT) gateway 1138 (e.g., the NAT gateway 1038 in FIG. 10). The control plane VCN 1116 can include a service gateway 1136 and a NAT gateway 1138.

[0105] The control plane VCN 1116 can include a data plane mirror app layer 1140 (e.g., the data plane mirror app layer 1040 of FIG. 10) that can include an app subnet 1126. The app subnet 1126 included in the data plane mirror app layer 1140 can include a virtual network interface controller (VNIC) 1142 (e.g., the VNIC 1042) that can execute a compute instance 1144 (e.g., similar to the compute instance 1044 of FIG. 10). The compute instance 1144 can facilitate communication between the app subnet 1126 of the data plane mirror app layer 1140 and an app subnet 1126 that can be included in the data plane app layer 1146 (e.g., the data plane app layer 1046 of FIG. 10) via the VNIC 1142 included in the data plane mirror app layer 1140 and the VNIC 1142 included in the data plane app layer 1146.

[0106] The internet gateway 1134 included in the control plane VCN 1116 can be communicatively coupled to a metadata management service 1152 (e.g., the metadata management service 1052 of FIG. 10) that can be communicatively coupled to the public internet 1154 (e.g., the public internet 1054 of FIG. 10). The public internet 1154 can be communicatively coupled to the NAT gateway 1138 included in the control plane VCN 1116. The service gateway 1136 included in the control plane VCN 1116 can be communicatively coupled to a cloud service 1156 (e.g., the cloud service 1056 of FIG. 10).

[0107] In some examples, the data plane VCN 1118 may be included in the customer's tenancy 1121. In this case, the IaaS provider may provide a control plane VCN 1116 for each customer, and the IaaS provider may configure, for each customer, the specific compute instances 1144 included in the service tenancy 1119. Each compute instance 1144 may enable communication between the control plane VCN 1116 included in the service tenancy 1119 and the data plane VCN 1118 included in the customer's tenancy 1121. The compute instance 1144 may enable the resources provisioned within the control plane VCN 1116 included in the service tenancy 1119 to be deployed or otherwise used in the data plane VCN 1118 included in the customer's tenancy 1121.

[0108] In another example, a customer of an IaaS provider may have a database that persists in the customer's tenancy 1121. In this example, the control plane VCN 1116 can include a data plane mirror app layer 1140 that can include an app subnet 1126. The data plane mirror app layer 1140 can exist in the data plane VCN 1118, but the data plane mirror app layer 1140 need not persist in the data plane VCN 1118. That is, the data plane mirror app layer 1140 may have access rights to the customer's tenancy 1121, but the data plane mirror app layer 1140 need not exist in the data plane VCN 1118 and need not be owned or operated by the customer of the IaaS provider. The data plane mirror app layer 1140 may be configured to make calls to the data plane VCN 1118, but need not be configured to make calls to any entity included in the control plane VCN 1116. The customer may wish to deploy or otherwise use resources within the data plane VCN 1118 that are provisioned within the control plane VCN 1116, and the data plane mirror app layer 1140 can facilitate the desired deployment or other use of the customer's resources.

[0109] In some embodiments, a customer of an IaaS provider can apply a filter to the data plane VCN 1118. In this embodiment, the customer can determine which data plane VCNs 1118 are accessible, and the customer may restrict access from the data plane VCN 1118 to the public Internet 1154. The IaaS provider may not be able to apply a filter or otherwise control access of the data plane VCN 1118 to any external network or database. Applying filters and controls by the customer to the data plane VCN 1118 included in the customer's tenancy 1121 can help to isolate the data plane VCN 1118 from other customers and from the public Internet 1154.

[0110] In some embodiments, the cloud service 1156 can be invoked by the service gateway 1136 to access services that may not exist on any of the public Internet 1154, the control plane VCN 1116, or the data plane VCN 1118. The connection between the cloud service 1156 and the control plane VCN 1116 or the data plane VCN 1118 need not be operational or continuous. The cloud service 1156 may exist on a different network owned or operated by an IaaS provider. The cloud service 1156 may be configured to receive calls from the service gateway 1136 and may be configured not to receive calls from the public Internet 1154. Some cloud services 1156 may be isolated from other cloud services 1156, and the control plane VCN 1116 may be isolated from cloud services 1156 that may not exist in the same region as the control plane VCN 1116. For example, the control plane VCN 1116 may be located in "Region 1", and the "Deployment 10" of the cloud service may be located in Region 1 and "Region 2". When a call to Deployment 10 is made by the service gateway 1136 included in the control plane VCN 1116 located in Region 1, this call may be sent to Deployment 10 within Region 1. In this example, the control plane VCN 1116, or Deployment 10 within Region 1, need not be communicatively coupled to, or otherwise communicate with, Deployment 10 within Region 2.

[0111] FIG. 12 is a block diagram 1200 showing another exemplary pattern of an IaaS architecture according to at least one embodiment. A service operator 1202 (e.g., service operator 1002 of FIG. 10) may be communicatively coupled to a secure host tenancy 1204 (e.g., secure host tenancy 1004 of FIG. 10) that can include a virtual cloud network (VCN) 1206 (e.g., VCN 1006 of FIG. 10) and a secure host subnet 1208 (e.g., secure host subnet 1008 of FIG. 10). The VCN 1206 can include an LPG 1210 (e.g., LPG 1010 of FIG. 10) and may be communicatively coupled to an SSH VCN 1212 (e.g., SSH VCN 1012 of FIG. 10) via the LPG 1210 included in the SSH VCN 1212. The SSH VCN 1212 can include an SSH subnet 1214 (e.g., SSH subnet 1014 of FIG. 10), and the SSH VCN 1212 may be communicatively coupled to a control plane VCN 1216 (e.g., control plane VCN 1016 of FIG. 10) via the LPG 1210 included in the control plane VCN 1216 and to a data plane VCN 1218 (e.g., data plane 1018 of FIG. 10) via the LPG 1210 included in the data plane VCN 1218. The control plane VCN 1216 and the data plane VCN 1218 may be included in a service tenancy 1219 (e.g., service tenancy 1019 of FIG. 10).

[0112] The control plane VCN1216 can include a control plane DMZ layer 1220 (e.g., the control plane DMZ layer 1020 of FIG. 10) that can include a load balancer (LB) subnet 1222 (e.g., the LB subnet 1022 of FIG. 10), a control plane application layer 1224 (e.g., the control plane application layer 1024 of FIG. 10) that can include an application subnet 1226 (similar to the application subnet 1026 of FIG. 10), and a control plane data layer 1228 (e.g., the control plane data layer 1028 of FIG. 10) that can include a DB subnet 1230. The LB subnet 1222 included in the control plane DMZ layer 1220 can be communicatively coupled to the application subnet 1226 included in the control plane application layer 1224 that can be included in the control plane VCN1216, and to an Internet gateway 1234 (e.g., the Internet gateway 1034 of FIG. 10). The application subnet 1226 can be communicatively coupled to the DB subnet 1230 included in the control plane data layer 1228, as well as to a service gateway 1236 (e.g., the service gateway of FIG. 10) and a network address translation (NAT) gateway 1238 (e.g., the NAT gateway 1038 of FIG. 10). The control plane VCN1216 can include the service gateway 1236 and the NAT gateway 1238.

[0113] The data plane VCN 1218 can include a data plane application layer 1246 (e.g., the data plane application layer 1046 in FIG. 10), a data plane DMZ layer 1248 (e.g., the data plane DMZ layer 1048 in FIG. 10), and a data plane data layer 1250 (e.g., the data plane data layer 1050 in FIG. 10). The data plane DMZ layer 1248 can include a reliable application subnet 1260 and an unreliable application subnet 1262 of the data plane application layer 1246 and an LB subnet 1222 communicatively coupled to an Internet gateway 1234 included in the data plane VCN 1218. The reliable application subnet 1260 can be communicatively coupled to a service gateway 1236 included in the data plane VCN 1218, a NAT gateway 1238 included in the data plane VCN 1218, and a DB subnet 1230 included in the data plane data layer 1250. The unreliable application subnet 1262 can be communicatively coupled to a service gateway 1236 included in the data plane VCN 1218 and a DB subnet 1230 included in the data plane data layer 1250. The data plane data layer 1250 can include a DB subnet 1230 communicatively coupled to a service gateway 1236 included in the data plane VCN 1218.

[0114] The untrusted application subnet 1262 can include one or more primary VNICs 1264(1) to (N) communicatively coupled to tenant virtual machines (VMs) 1266(1) to (N). Each tenant VM 1266(1) to (N) can be communicatively coupled to respective application subnets 1267(1) to (N) that can be included in respective container egress VCNs 1268(1) to (N) that can be included in respective customer tenancies 1270(1) to (N). Each secondary VNIC 1272(1) to (N) can facilitate communication between the untrusted application subnet 1262 included in the data plane VCN 1218 and the application subnets included in the container egress VCNs 1268(1) to (N). Each container egress VCN 1268(1) to (N) can include a NAT gateway 1238 communicatively coupled to the public internet 1254 (e.g., the public internet 1054 of FIG. 10).

[0115] The internet gateway 1234 included in the control plane VCN 1216 and the data plane VCN 1218 can be communicatively coupled to a metadata management service 1252 (e.g., the metadata management system 1052 of FIG. 10) communicatively coupled to the public internet 1254. The public internet 1254 can be communicatively coupled to the NAT gateway 1238 included in the control plane VCN 1216 and the data plane VCN 1218. The service gateway 1236 included in the control plane VCN 1216 and the data plane VCN 1218 can be communicatively coupled to a cloud service 1256.

[0116] In some embodiments, the data plane VCN 1218 may be integrated with the customer's tenancy 1270. This integration may, in some cases, be useful or desirable for customers of the IaaS provider, such as when they may desire support when running code. A customer may provide code to execute that may be disruptive, communicate with other customers' resources, or otherwise cause unwanted effects. In response, the IaaS provider may determine whether to execute code provided to the IaaS provider by the customer.

[0117] In some examples, a customer of an IaaS provider may grant the IaaS provider temporary network access rights and request a function to be connected to the data plane application layer 1246. The code for executing this function may be executed in the VMs 1266(1) to (N), and this code need not be configured to execute elsewhere on the data plane VCN 1218. Each of the VMs 1266(1) to (N) may be connected to the tenancy 1270 of one customer. Each of the containers 1271(1) to (N) included in the VMs 1266(1) to (N) may be configured to execute the code. In this case, double separation can exist (for example, the containers 1271(1) to (N) executing the code, the containers 1271(1) to (N) may be included in at least the VMs 1266(1) to (N) included in the untrusted application subnet 1262), which can help prevent incorrect or otherwise undesirable code from damaging the IaaS provider's network or damaging the networks of different customers. The containers 1271(1) to (N) may be communicatively coupled to the customer's tenancy 1270 and may be configured to send or receive data with the customer's tenancy 1270. The containers 1271(1) to (N) need not be configured to send or receive data with any other entity within the data plane VCN 1218. Upon completion of the execution of the code, the IaaS provider may force the containers 1271(1) to (N) to terminate or otherwise discard them.

[0118] In some embodiments, the trusted application subnet 1260 may execute code owned or operated by an IaaS provider. In this embodiment, the trusted application subnet 1260 may be communicatively coupled to the DB subnet 1230 and may be configured to execute CRUD operations within the DB subnet 1230. The untrusted application subnet 1262 may be communicatively coupled to the DB subnet 1230, but in this embodiment, the untrusted application subnet may be configured to execute read operations within the DB subnet 1230. The containers 1271(1)-(N) that can execute customer code, which may be included in each customer's VMs 1266(1)-(N), may not be communicatively coupled to the DB subnet 1230.

[0119] In other embodiments, the control plane VCN 1216 and the data plane VCN 1218 may not be directly communicatively coupled. In this embodiment, there may be no direct communication between the control plane VCN 1216 and the data plane VCN 1218. However, communication can occur indirectly by at least one method. The LPG 1210 may be established by an IaaS provider, thereby facilitating communication between the control plane VCN 1216 and the data plane VCN 1218. In another example, the control plane VCN 1216 or the data plane VCN 1218 may make calls to cloud services 1256 via the service gateway 1236. For example, a call from the control plane VCN 1216 to cloud services 1256 may include a request for a service that can communicate with the data plane VCN 1218.

[0120] FIG. 13 is a block diagram 1300 showing another exemplary pattern of an IaaS architecture according to at least one embodiment. A service operator 1302 (e.g., service operator 1002 of FIG. 10) can be communicatively coupled to a secure host tenancy 1304 (e.g., secure host tenancy 1004 of FIG. 10) that can include a virtual cloud network (VCN) 1306 (e.g., VCN 1006 of FIG. 10) and a secure host subnet 1308 (e.g., secure host subnet 1008 of FIG. 10). The VCN 1306 can include an LPG 1310 (e.g., LPG 1010 of FIG. 10) and can be communicatively coupled to an SSH VCN 1312 (e.g., SSH VCN 1012 of FIG. 10) via the LPG 1310 included in the SSH VCN 1312. The SSH VCN 1312 can include an SSH subnet 1314 (e.g., SSH subnet 1014 of FIG. 10), and the SSH VCN 1312 can be communicatively coupled to a control plane VCN 1316 (e.g., control plane VCN 1016 of FIG. 10) via the LPG 1310 included in the control plane VCN 1316 and to a data plane VCN 1318 (e.g., data plane 1018 of FIG. 10) via the LPG 1310 included in the data plane VCN 1318. The control plane VCN 1316 and the data plane VCN 1318 can be included in a service tenancy 1319 (e.g., service tenancy 1019 of FIG. 10).

[0121] The control plane VCN 1316 can include a control plane DMZ layer 1320 (e.g., the control plane DMZ layer 1020 of FIG. 10) that can include an LB subnet 1322 (e.g., the LB subnet 1022 of FIG. 10), a control plane application layer 1324 (e.g., the control plane application layer 1024 of FIG. 10) that can include an application subnet 1326 (e.g., the application subnet 1026 of FIG. 10), and a control plane data layer 1328 (e.g., the control plane data layer 1028 of FIG. 10) that can include a DB subnet 1330 (e.g., the DB subnet 1230 of FIG. 12). The LB subnet 1322 included in the control plane DMZ layer 1320 can be communicatively coupled to the application subnet 1326 included in the control plane application layer 1324 that can be included in the control plane VCN 1316, and to an Internet gateway 1334 (e.g., the Internet gateway 1034 of FIG. 10). The application subnet 1326 can be communicatively coupled to the DB subnet 1330 included in the control plane data layer 1328, and to a service gateway 1336 (e.g., the service gateway of FIG. 10) and a network address translation (NAT) gateway 1338 (e.g., the NAT gateway 1038 of FIG. 10). The control plane VCN 1316 can include the service gateway 1336 and the NAT gateway 1338.

[0122] The data plane VCN 1318 can include a data plane application layer 1346 (e.g., the data plane application layer 1046 of FIG. 10), a data plane DMZ layer 1348 (e.g., the data plane DMZ layer 1048 of FIG. 10), and a data plane data layer 1350 (e.g., the data plane data layer 1050 of FIG. 10). The data plane DMZ layer 1348 can include a trusted application subnet 1360 (e.g., the trusted application subnet 1260 of FIG. 12) and an untrusted application subnet 1362 (e.g., the untrusted application subnet 1262 of FIG. 12) of the data plane application layer 1346, and an LB subnet 1322 communicatively coupled to an Internet gateway 1334 included in the data plane VCN 1318. The trusted application subnet 1360 can be communicatively coupled to a service gateway 1336 included in the data plane VCN 1318, a NAT gateway 1338 included in the data plane VCN 1318, and a DB subnet 1330 included in the data plane data layer 1350. The untrusted application subnet 1362 can be communicatively coupled to a service gateway 1336 included in the data plane VCN 1318, and a DB subnet 1330 included in the data plane data layer 1350. The data plane data layer 1350 can include a DB subnet 1330 communicatively coupled to a service gateway 1336 included in the data plane VCN 1318.

[0123] The untrusted application subnet 1362 can include primary VNICs 1364(1) to (N) communicatively coupled to tenant virtual machines (VMs) 1366(1) to (N) existing within the untrusted application subnet 1362. Each tenant VM 1366(1) to (N) can execute code within its respective containers 1367(1) to (N) and can be communicatively coupled to an application subnet 1326 that can be included in a data plane application layer 1346 that can be included in a container egress VCN 1368. Each secondary VNIC 1372(1) to (N) can facilitate communication between the untrusted application subnet 1362 included in the data plane VCN 1318 and the application subnet included in the container egress VCN 1368. The container egress VCN can include a NAT gateway 1338 communicatively coupled to a public internet 1354 (e.g., the public internet 1054 of FIG. 10).

[0124] The internet gateway 1334 included in the control plane VCN 1316 and in the data plane VCN 1318 can be communicatively coupled to a metadata management service 1352 (e.g., the metadata management system 1052 of FIG. 10) communicatively coupled to a public internet 1354. The public internet 1354 can be communicatively coupled to a NAT gateway 1338 included in the control plane VCN 1316 and in the data plane VCN 1318. The service gateway 1336 included in the control plane VCN 1316 and in the data plane VCN 1318 can be communicatively coupled to a cloud service 1356.

[0125] In some examples, the pattern shown by the architecture of block diagram 1300 of FIG. 13 may be regarded as an exception to the pattern shown by the architecture of block diagram 1200 of FIG. 12, which may be desirable for customers of an IaaS provider when the IaaS provider cannot communicate directly with a customer (e.g., a disconnected region). Each of the containers 1367(1) to (N) included in VM1366(1) to (N) for each customer may be accessed in real time by the customer. The containers 1367(1) to (N) may be configured to make calls to respective secondary VNICs 1372(1) to (N) included in the application subnet 1326 of the data plane application layer 1346 that may be included in the container egress VCN 1368. The secondary VNICs 1372(1) to (N) may be able to send the calls to the NAT gateway 1338, and the NAT gateway 1338 may send the calls to the public Internet 1354. In this example, the containers 1367(1) to (N) that may be accessed in real time by the customer can be separated from the control plane VCN 1316 and may be separated from other entities included in the data plane VCN 1318. The containers 1367(1) to (N) may also be separated from the resources of other customers.

[0126] In another example, a customer can call cloud service 1356 using containers 1367(1) to (N). In this example, the customer may execute the code within containers 1367(1) to (N) that requests a service from cloud service 1356. Containers 1367(1) to (N) can send this request to secondary VNICs 1372(1) to (N), and secondary VNICs 1372(1) to (N) can send this request to a NAT gateway, and the NAT gateway can send this request to public internet 1354. Public internet 1354 can send this request to LB subnet 1322 included in control plane VCN 1316 via internet gateway 1334. In response to determining that this request is valid, the LB subnet can send this request to app subnet 1326, and app subnet 1326 can send this request to cloud service 1356 via service gateway 1336.

[0127] It should be understood that the IaaS architectures 1000, 1100, 1200, 1300 shown in the figures may include components other than the components shown. Further, the embodiments shown in the figures are merely some examples of cloud infrastructure systems that can incorporate embodiments of the present disclosure. In some other embodiments, the IaaS system may include more or fewer components than the components shown in the figures, combine two or more components, or have different configurations or arrangements of components.

[0128] In one embodiment, the IaaS system described herein may include the provision of a series of application, middleware, and database services that are delivered to customers in a self-service, subscription-based, elastically scalable, reliable, highly available, and secure manner. An example of such an IaaS system is Oracle Cloud Infrastructure (OCI) provided by the present assignee.

[0129] FIG. 14 shows an exemplary computer system 1400 in which various embodiments may be implemented. System 1400 may be used to implement any of the computer systems described above. As shown in the figure, computer system 1400 includes a processing unit 1404 that communicates with a plurality of peripheral subsystems via a bus subsystem 1402. These peripheral subsystems may include a processing acceleration unit 1406, an I / O subsystem 1408, a storage subsystem 1418, and a communication subsystem 1424. Storage subsystem 1418 includes tangible computer-readable storage media 1422 and system memory 1410.

[0130] The bus subsystem 1402 provides a mechanism for the various components and subsystems of the computer system 1400 to communicate with each other as intended. Although the bus subsystem 1402 is schematically shown as a single bus, alternative embodiments of the bus subsystem may utilize multiple buses. The bus subsystem 1402 may be any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a local bus that uses any of a variety of bus architectures. For example, such architectures may include an ISA (Industry Standard Architecture) bus, an MCA (Micro Channel Architecture) bus, an EISA (Enhanced ISA) bus, a VESA (Video Electronics Standards Association) local bus, and a PCI (Peripheral Component Interconnect) bus implemented as a mezzanine bus manufactured to the IEEE P1386.1 standard.

[0131] The processing unit 1404, which may be implemented as one or more integrated circuits (e.g., conventional microprocessors or microcontrollers), controls the operation of the computer system 1400. One or more processors may be included in the processing unit 1404. These processors may include single-core processors or multi-core processors. In certain embodiments, the processing unit 1404 may be implemented as one or more independent processing units 1432 and / or 1434, with a single-core processor or multi-core processor included in each processing unit. In other embodiments, the processing unit 1404 may be implemented as a quad-core processing unit formed by integrating two dual-core processors on a single chip.

[0132] In various embodiments, processing unit 1404 can execute various programs according to program code and can maintain multiple programs or processes running simultaneously. At any given time, some or all of the program code being executed can be present in processor 1404 and / or storage subsystem 1418. With appropriate programming, processor 1404 can provide the various functions described above. Computer system 1400 may further include a processing acceleration unit 1406 that can include a digital signal processor (DSP), an application specific processor, and / or the like.

[0133] The I / O subsystem 1408 may include user interface input devices and user interface output devices. The user interface input devices may include a keyboard, a pointing device such as a mouse or trackball, a touchpad or touch screen incorporated in a display, a scroll wheel, a click wheel, a dial, buttons, switches, a keypad, a voice input device with a voice command recognition system, a microphone, and other types of input devices. The user interface input devices may enable a user to interact with input devices such as a Microsoft Xbox (registered trademark) 360 game controller via a natural user interface using gestures and spoken commands, and may include motion detection devices and / or gesture recognition devices such as a Microsoft Kinect (registered trademark) motion sensor. The user interface input devices may include gesture recognition devices such as a Google Glass (registered trademark) blink detector that detects a user's eye activity (e.g., a blink when taking a photo and / or selecting a menu) and converts it into an input to the input device (e.g., Google Glass (registered trademark)). Further, the user interface input devices may include a voice recognition detection device that enables a user to interact with a voice recognition system (e.g., a Siri (registered trademark) navigator) via voice commands.

[0134] The user interface input device may include, but is not limited to, a three-dimensional (3D) mouse, a joystick or a pointing stick, a game pad, and a graphic tablet, as well as audio / visual devices such as a speaker, a digital camera, a digital video camera, a portable media player, a web camera, an image scanner, a fingerprint scanner, a barcode reader, a 3D scanner, a 3D printer, a laser distance meter, and an eye tracking device. Further, the user interface input device may include, for example, a medical image input device such as a computed tomography, a magnetic resonance imaging, a positron emission tomography, and a medical ultrasonic examination device. The user interface input device may also include, for example, an audio input device such as a MIDI keyboard and a digital musical instrument.

[0135] The user interface output device may include, other than visual displays such as a display subsystem, an indicator light, or an audio output device. The display subsystem may be a flat panel device such as a flat panel device using a cathode ray tube (CRT), a liquid crystal display (LCD), or a plasma display, a projection device, a touch screen, and the like. Generally, the use of the term "output device" is intended to include all possible types of devices and mechanisms for outputting information from the computer system 1400 to the user or another computer. For example, the user interface output device may include, but is not limited to, various display devices for visually transmitting text information, graphics information, and audio / video information, such as a monitor, a printer, a speaker, headphones, a car navigation system, a plotter, an audio output device, and a modem.

[0136] The computer system 1400 may comprise a storage subsystem 1418 that includes software elements as shown currently within the system memory 1410. The system memory 1410 may store data generated during the execution of these programs in addition to program instructions that are readable and executable by the processing unit 1404.

[0137] Depending on the configuration and type of the computer system 1400, the system memory 1410 may be volatile (such as random access memory (RAM)) and / or non-volatile (such as read-only memory (ROM), flash memory, etc.). RAM is typically immediately accessible by the processing unit 1404 and / or contains data and / or program services that are currently being operated on and executed. In some implementations, the system memory 1410 may include multiple different types of memory, such as static random access memory (SRAM) or dynamic random access memory (DRAM). In some implementations, a basic input / output system (BIOS) that includes basic routines useful for transferring information between elements within the computer system 1400, such as during startup, may typically be stored in ROM. By way of example and not limitation, the system memory 1410 also shows application programs 1412, program data 1414, and an operating system 1416, which may include client applications, web browsers, mid-tier applications, relational database management systems (RDBMS), etc.Examples of the operating system 1416 may include Microsoft Windows®, Apple Macintosh®, and / or Linux operating systems, various commercially available UNIX® or UNIX-like operating systems (including, but not limited to, various GNU / Linux operating systems, Google Chrome® OS, etc.), and / or various versions of mobile operating systems such as iOS, Windows® Phone, Android® OS, BlackBerry® OS, and Palm® OS.

[0138] The storage subsystem 1418 may provide a tangible computer-readable storage medium for storing basic programming and data configurations that provide the functionality of some embodiments. Software (programs, code services, instructions) that provides the aforementioned functionality when executed by a processor may be stored in the storage subsystem 1418. These software services or instructions may be executed by the processing unit 1404. The storage subsystem 1418 may provide a repository for storing data used in accordance with the present disclosure.

[0139] The storage subsystem 1400 may include a computer-readable storage medium reader 1420 that may be further connected to a computer-readable storage medium 1422. In combination with the system memory 1410, together, optionally, the computer-readable storage medium 1422 may comprehensively represent remote storage devices, local storage devices, fixed storage devices, and / or removable storage devices in addition to a storage medium for temporarily and / or more persistently containing, storing, transmitting, and retrieving computer-readable information.

[0140] A computer-readable storage medium 1422 that includes code or a portion of code can include any suitable medium known in or used in the art, including storage media and communication media such as volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing and / or transmitting information, but not limited to these. The computer-readable storage medium 1422 can include tangible computer-readable storage media such as RAM, ROM, electronically erasable programmable ROM (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile disk (DVD), or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage, or other magnetic storage devices, or other tangible computer-readable media. The computer-readable storage medium 1422 can also include non-tangible computer-readable media such as data signals, data transmissions, or any other medium that can be used to transmit desired information and can be accessed by the computing system 1400.

[0141] As an example, computer-readable storage medium 1422 may include a hard disk drive that reads from or writes to a removable non-volatile magnetic medium, a magnetic disk drive that reads from or writes to a removable non-volatile magnetic disk, and an optical disk drive that reads from or writes to a removable non-volatile optical disk such as a CD ROM, DVD, and Blu-ray (registered trademark) disk, or other optical media. Computer-readable storage medium 1422 may include, but is not limited to, a Zip (registered trademark) drive, a flash memory card, a universal serial bus (USB) flash drive, a secure digital (SD) card, a DVD disk, a digital video tape, etc. Computer-readable storage medium 1422 may include solid-state drives (SSDs) based on non-volatile memory such as flash memory-based semiconductor drives, enterprise flash drives, semiconductor ROMs, SSDs based on volatile memory such as semiconductor RAM, dynamic RAM, static RAM, DRAM-based SSDs, magnetoresistive RAM (MRAM) SSDs, and hybrid SSDs that use a combination of DRAM and flash memory-based SSDs. Disk drives and associated computer-readable media may provide non-volatile storage of computer-readable instructions, data structures, program services, and other data of computer system 1400.

[0142] The communication subsystem 1424 provides an interface to other computer systems and networks. The communication subsystem 1424 functions as an interface for receiving data from other systems of the computer system 1400 and for transmitting data to other systems. For example, the communication subsystem 1424 may enable the computer system 1400 to connect to one or more devices via the Internet. In some embodiments, the communication subsystem 1424 may include components of a radio frequency (RF) transceiver for accessing wireless voice and / or data networks (e.g., cellular phone technology, advanced data network technologies such as 3G, 4G, or EDGE (enhanced data rates for global evolution), WiFi (IEEE 802.11 family of standards, or other mobile communication technologies, or any combination thereof), components of a global positioning system (GPS) receiver, and / or other components. In some embodiments, the communication subsystem 1424 may provide a wired network connection (e.g., Ethernet (registered trademark)) in addition to, or instead of, the wireless interface.

[0143] In some embodiments, the communication subsystem 1424 may receive input communications in the form of structured and / or unstructured data feeds 1426, event streams 1428, event updates 1430, etc., on behalf of one or more users who may use the computer system 1400.

[0144] As an example, the communication subsystem 1424 may be configured to receive in real time a data feed 1426 from social networks such as Twitter (registered trademark) feeds, Facebook (registered trademark) updates, and / or other communication services, web feeds such as Rich Site Summary (RSS) feeds, and / or real-time updates from one or more third-party information sources.

[0145] Furthermore, the communication subsystem 1424 may be configured to receive data in the form of a continuous data stream, which may include an event stream 1428 and / or event updates 1430 of real-time events that have no explicit end, are essentially continuous, or have no boundaries. Examples of applications that generate continuous data can include, for example, sensor data applications, financial tickers, network performance measurement tools (e.g., network monitoring and traffic management applications), clickstream analysis tools, automotive traffic monitoring, and the like.

[0146] The communication subsystem 1424 may be configured to output structured and / or unstructured data feeds 1426, event streams 1428, event updates 1430, etc. to one or more databases that can communicate with one or more streaming data source computers coupled to the computer system 1400.

[0147] The computer system 1400 can be one of various types, including a handheld portable device (e.g., an iPhone (registered trademark) mobile phone, an iPad (registered trademark) computing tablet, a PDA), a wearable device (e.g., a Google Glass (registered trademark) head-mounted display), a PC, a workstation, a mainframe, a ticket vending machine, a server rack, or any other data processing system.

[0148] Due to the constantly changing nature of computers and networks, the description of the computer system 1400 shown in the figures is merely intended to be a specific example. Many other configurations are possible that include more or fewer components than the system shown in the figures. For example, customized hardware may be used and / or certain elements may be implemented in hardware, firmware, software (including applets), or combinations thereof. Additionally, connections to other computing devices such as network input / output devices may be employed. Based on the disclosure and teachings provided herein, those skilled in the art will understand other methods and / or ways to implement various embodiments.

[0149] Embodiments may be implemented by using a computer program product that includes computer programs / instructions, which, when executed by a processor, cause the processor to perform any of the methods described in this disclosure.

[0150] Although specific embodiments have been described, various modifications, changes, alternative structures, and equivalents are also included within the scope of this disclosure. Embodiments are not limited to operating within a particular data processing environment and can operate freely within multiple data processing environments. Further, although embodiments have been described using a specific series of transactions and steps, it should be apparent to those skilled in the art that the scope of this disclosure is not limited to the series of transactions and steps described. The various features and aspects of the foregoing embodiments may be used individually or together.

[0151] Furthermore, while embodiments have been described using specific combinations of hardware and software, it should be recognized that other combinations of hardware and software are within the scope of the present disclosure. Embodiments may be implemented using only hardware, or only software, or combinations thereof. The various processes described herein may be implemented on the same processor or different processors in any combination. Thus, when a component or service is described as being configured to perform an operation, such a configuration may be realized, for example, by designing an electronic circuit to perform this operation, by programming a programmable electronic circuit (such as a microprocessor) to perform this operation, or by any combination thereof. Processes can communicate using a variety of techniques including, but not limited to, prior art techniques for inter-process communication, different pairs of processes may use different techniques, or the same pair of processes may use different techniques at different times.

[0152] Accordingly, the specification and drawings are to be regarded as illustrative rather than restrictive. However, it is clear that additions, deletions, omissions, as well as other modifications and changes may be made without departing from the broader ideas and scope as set forth in the claims. Thus, while specific embodiments of the disclosure have been described, these are not intended to be limiting. Various changes and equivalents are within the scope of the appended claims.

[0153] The terms "a", "an", and "the" and similar referents used in the context of describing the disclosed embodiments (in particular, in the context of the appended claims) are to be construed to cover both the singular and the plural unless specifically indicated otherwise herein or clearly contradicted by the context. The terms "comprising", "having", "including", and "containing" are to be construed as open-ended terms (i.e., meaning "including, but not limited to") unless otherwise noted. The term "connected" is to be construed to mean either internally or in part or completely contained in, connected to, or joined together with, even if there is something intervening. The recitation of ranges of values herein is merely intended to serve as a convenient method of referring individually to each separate value falling within the range unless otherwise indicated herein, and each separate value is incorporated herein as if it were individually recited herein. All methods described herein can be performed in any suitable order unless otherwise indicated herein or otherwise clearly contradicted by the context. The use of any examples, or exemplary language (e.g., "such as") provided herein is merely intended to better illuminate the embodiments and does not impose a limitation on the scope of the disclosure unless otherwise claimed. No language in this specification should be construed as indicating any non-claimed element as essential to the practice of the disclosure.

[0154] Disjunctive language, such as the phrase "at least one of X, Y, or Z," is generally intended, unless specifically stated otherwise, to convey that items, conditions, etc. may be any one of X, Y, or Z, or any combination thereof (e.g., X, Y, and / or Z) within the context in which it is used. Thus, such disjunctive language is generally not intended, and should not be taken, to mean that a particular embodiment requires the presence of at least one of each of at least one of X, at least one of Y, or at least one of Z.

[0155] In this specification, preferred embodiments of the present disclosure are described, including the best mode known to the applicant for carrying out the present disclosure. Variations of such preferred embodiments may become apparent to those skilled in the art upon reading the foregoing description. Those skilled in the art should be able to adopt such variations as appropriate, and the present disclosure may be practiced otherwise than as specifically described herein. Accordingly, the present disclosure includes all modifications and equivalents of the subject matter recited in the claims appended hereto as permitted by applicable law. Further, any combination of the foregoing elements in all possible variations of the embodiments is included in the present disclosure unless otherwise specifically indicated herein.

[0156] All references, including publications, patent applications, and patents, cited herein are hereby incorporated by reference in their entirety, to the same extent as if each reference were individually and specifically indicated to be incorporated by reference and were set forth in its entirety herein.

[0157] In the foregoing specification, aspects of the present disclosure have been described with reference to specific embodiments of the present specification. However, those skilled in the art will recognize that the present disclosure is not limited thereto. The various features and aspects of the foregoing disclosure may be used individually or together. Further, the embodiments may be utilized in any number of environments and applications beyond those described herein, without departing from the broader spirit and scope of the present specification. Accordingly, the present specification and drawings are to be regarded as illustrative rather than restrictive.

Claims

1. 1. A computer-implemented method comprising: Detecting that a computing instance may be infected with ransomware; and and triggering an operation to monitor transitions in a cache associated with an exception level of a processor of the computing instance, the operation comprising: collecting security metrics associated with the exception levels of the processor, the security metrics including a number of times the processor utilizes an exception level that indicates a secure state of the processor, the operations further comprising: comparing said security indicator with a threshold indicator; determining that a ransomware attack has occurred based at least in part on comparing the security indicator to the threshold indicator, the method further comprising: A computer-implemented method comprising: sending a message to a job scheduler to reschedule workload directed to the computing instance based at least in part on the determination that the ransomware attack has occurred.

2. 10. The computer-implemented method of claim 1, wherein detecting that the computing instance may be infected with ransomware comprises detecting a change in a mapping of cache locations to memory locations.

3. 3. The computer-implemented method of claim 1 or 2, wherein detecting that the computing instance may be infected with ransomware comprises detecting that a number of attempted transitions to a secure state by the computing instance exceeds a threshold number.

4. The computer-implemented method of claim 1 or 2, wherein the method further comprises migrating the workload off the computing instance.

5. The method comprises: generating a first encryption bitmap including a first row of encryption-related data associated with the cache; generating a second encryption bitmap including a second row of encryption-related data associated with the cache; performing a mathematical exclusive operation on the first row and the second row to derive a difference value; and comparing the difference value to a threshold value.

3. The computer-implemented method of claim 1 or 2, wherein determining that the ransomware attack has occurred is further based on comparing the difference value to a threshold value.

6. 3. The computer-implemented method of claim 1, further comprising: repaving the computing instance based at least in part on the determination that the ransomware attack has occurred.

7. The computer-implemented method of claim 1 or 2, wherein the exception level is one or more exception levels each associated with a privilege level for accessing one or more secure resources.

8. a processor; a computer-readable medium containing instructions that, when executed by the processor, cause the processor to: Detecting that a computing instance may be infected with ransomware; and and triggering an operation to monitor transitions in a cache associated with an exception level of a processor of the computing instance, the operation comprising: collecting security metrics associated with the exception levels of the processor, the security metrics including a number of times the processor utilizes an exception level that indicates a secure state of the processor, the operations further comprising: comparing said security indicator with a threshold indicator; and determining that a ransomware attack has occurred based at least in part on comparing the security indicator to the threshold indicator, the instructions further causing the processor to: and a cloud infrastructure node that, based at least in part on the determination that the ransomware attack has occurred, sends a message to a job scheduler to cause the cloud infrastructure node to reschedule workloads directed to the computing instance.

9. 10. The cloud infrastructure node of claim 8, wherein detecting that the computing instance may be infected with ransomware comprises detecting a change in a mapping of cache locations to memory locations.

10. 10. The cloud infrastructure node of claim 8 or 9, wherein detecting that the computing instance may be infected with ransomware comprises detecting that a number of attempted transitions to a secure state by the computing instance exceeds a threshold number.

11. 10. The cloud infrastructure node of claim 8 or 9, wherein the instructions further cause the processor to migrate the workload off the computing instance.

12. The instructions cause the processor to: generating a first encryption bitmap including a first row of encryption-related data associated with the cache; generating a second encryption bitmap including a second row of encryption-related data associated with the cache; performing a mathematical exclusive operation on the first row and the second row to derive a difference value; comparing the difference value with a threshold value; 10. The cloud infrastructure node of claim 8 or 9, wherein determining that a ransomware attack has occurred is further based on comparing the difference value to a threshold.

13. 10. The cloud infrastructure node of claim 8 or 9, wherein the instructions further cause the processor to repave the computing instance based at least in part on the determination that the ransomware attack has occurred.

14. 10. The cloud infrastructure node of claim 8 or 9, wherein the exception level is one or more exception levels each associated with a privilege level for accessing one or more secure resources.

15. A computer readable program comprising a sequence of instructions stored thereon, the instructions, when executed by a processor of a cloud infrastructure node, causing the processor to: Detecting that a computing instance may be infected with ransomware; and and triggering an operation of monitoring transitions in a cache associated with an exception level of a processor of the computing instance, the operation comprising: collecting security metrics associated with the exception levels of the processor, the security metrics including a number of times the processor utilizes an exception level that indicates a secure state of the processor, the operations further comprising: comparing said security indicator with a threshold indicator; and determining that a ransomware attack has occurred based at least in part on comparing the security indicator to the threshold indicator, the instructions further causing the processor to:

11. A computer-readable program that causes an attacker to perform operations including, based at least in part on the determination that the ransomware attack has occurred, sending a message to a job scheduler to reschedule workloads directed to the computing instance.

16. 16. The computer-readable program of claim 15, wherein detecting that the computing instance may be infected with ransomware comprises detecting a change in a mapping of cache locations to memory locations.

17. 17. The computer-readable program of claim 15 or 16, wherein detecting that the computing instance may be infected with ransomware comprises detecting that a number of attempted transitions to a secure state by the computing instance exceeds a threshold number.

18. 17. The computer readable program of claim 15 or 16, wherein the operations further comprise migrating the workload off the computing instance.

19. The operation is generating a first encryption bitmap including a first row of encryption-related data associated with the cache; generating a second encryption bitmap including a second row of encryption-related data associated with the cache; performing a mathematical exclusive operation on the first row and the second row to derive a difference value; comparing the difference value to a threshold; 17. The computer readable program of claim 15 or 16, wherein determining that the ransomware attack has occurred is further based on comparing the difference value to a threshold.

20. 17. The computer readable program of claim 15 or 16, wherein the exception level is one or more exception levels each associated with a privilege level for accessing one or more secure resources.

Images