Entropy-Based Security Detection for Virtual Instances
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software defined networking (SDN) environments with virtual machines (VMs) face challenges in distinguishing between malicious and non-malicious behaviors due to the limitations of short or long learning periods for generating behavior histories, leading to false alarms or missed threats.
Innovation Solution
The implementation of an 'intended state' data set, which compares the behavior of a VM to a healthy computing environment, allowing for the detection of security threats without relying solely on behavior histories, using a detection system that monitors and generates an intended state based on observed behaviors from multiple VMs to identify outliers and potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If a short learning period is used to generate behavior history, then the security manager can begin protection sooner, but false alarms increase
Solution Approach 1:
The patent introduces an entropy-based detection system as an intermediary layer between the behavior history generation and threat detection processes. This system calculates entropy values for observed behaviors and compares them against threshold values, allowing for rapid protection deployment while maintaining reliability through statistical anomaly detection rather than relying solely on lengthy behavior history accumulation.
Solution Approach 2:
The patent transforms the detection approach by changing the parameter from behavioral pattern matching (which requires extensive history) to entropy calculation (which can be performed with limited data). By calculating entropy H(X) = -Σ p(x) log p(x) for observed behaviors and comparing against thresholds, the system achieves reliable threat detection with shorter learning periods.
2Reliability
If a long learning period is used to generate behavior history, then false alarms are reduced, but the VM remains unprotected during the learning period
Solution Approach 1:
The patent implements preliminary entropy-based threat detection capabilities that can operate immediately upon VM deployment, before a comprehensive behavior history is established. The system pre-calculates entropy thresholds based on common malicious behavior patterns and can detect threats in real-time from the outset, eliminating the unprotected learning period while maintaining low false alarm rates through statistical validation.
3Reliability
If behavior history is used for threat detection, then protection is provided, but malicious behaviors observed during learning are not detected
Solution Approach 1:
The patent inverts the traditional approach by not assuming that behaviors observed during the learning period are benign. Instead, it continuously calculates entropy for all observed behaviors and compares against dynamically updated thresholds. This inversion allows the system to detect malicious behaviors even when they appear during the learning period, as the entropy-based anomaly detection does not automatically normalize observed patterns as safe.
4Measurement precision
If entropy-based detection with multiple VMs is used, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent creates a universal entropy calculation framework that can be applied across multiple VMs with the same detection logic and threshold comparison mechanism. The system aggregates entropy calculations from multiple VMs to establish more robust baseline thresholds, improving detection accuracy through statistical power while maintaining a relatively simple and uniform detection algorithm that can be deployed consistently across the virtualized environment.
Data Source
AI summary
A virtual computing instance (VCI) is protected against security threats by a security manager, monitoring a behavior of a VCI over an observation period. The method further includes, storing by the security manager a digital profile in a first database, wherein the digital profile comprises information indicative of the behavior. The method further includes, accessing by a detection system, the digital profile from the first database, and accessing by the detection system, an intended state associated with VCI, wherein the intended state comprises information indicative of a behavior from a second VCI. The method further includes, comparing at least part of the digital profile to the at least part of the intended state. The method further includes, determining by the detection system, that the VCI contains a security threat when information indicative of a behavior in the digital profile is an outlier.