System and method for managing formation and modification of a cluster within a malware detection system

A system comprising:

• a plurality of computing nodes including at least a first computing node operating as a broker computing node, a second computing node operating as an analytic computing node with a first cluster;
• and
• a management system communicatively coupled to the plurality of computing nodes, the management system being configured to manage a formation of a cluster in response to detecting a first event and to manage a modification of the first cluster including at least the plurality of computing nodes in response to a second event,
• wherein at least the second event includes either (i) receipt of a message to join the cluster from a third computing node that engages in a handshaking scheme to exchange credentials with the third computing node to receive the request message over a secure channel, a credential of the first computing node includes the identifier being a public key of the first computing node and prompts analysis of a workload for each cluster managed by the management system including the first cluster or (ii) detecting of a degradation in operability of a particular computing node of the plurality of computing nodes.

A system comprising:

• a plurality of computing nodes including at least a first computing node operating as a broker computing node and at least a second computing node operating as an analytic computing node;
• and
• a management system communicatively coupled to the plurality of computing nodes, the management system being configured to (i) manage a formation of a first cluster in response to detecting a first event, and (ii) manage a modification of the first cluster including at least the plurality of computing nodes in response to a second event,
• wherein at least the second event includes either (i) receipt of a message to join the cluster that prompts an analysis of a workload for each cluster managed by the management system including the first cluster or (ii) detecting of a degradation in operability of a particular computing node of the plurality of computing nodes, and
• wherein the management system being configured to manage the modification of the first cluster by at least (i) assigning a third computing node to the first cluster based on the analysis of the workload of each cluster of a plurality of clusters including the first cluster, (ii) placing an identifier for the third computing node within a listing associated with the first cluster where the listing includes identifiers associated with computing nodes forming the first cluster, and (iii) transmitting one or more notification messages for receipt by at least a portion of the plurality of computing nodes of the modification to the first cluster.

A system comprising:

• a plurality of computing nodes including at least a first computing node operating as a broker computing node and at least a second computing node operating as an analytic computing node with a first cluster;
• and
• a management system communicatively coupled to the plurality of computing nodes, the management system being configured to (i) manage a formation of a cluster in response to detecting a first event, (ii) manage a modification of the first cluster including at least the plurality of computing nodes in response to a second event, and (iii) analyze the workload of each cluster managed by the management system by at least conducting an analysis of a workload of each computing node of a corresponding cluster by at least analyzing a number of timeout events experienced by each computing node, the number of timeout events identifies delayed processing of a suspicious object,
• wherein at least the second event includes either (i) receipt of the message from a third computing node to join the cluster that prompts analysis of a workload for each cluster managed by the management system including the first cluster wherein the number of timeout events may be a factor in the assigning of the third computing node issuing a message to join the corresponding cluster or (ii) detecting of a degradation in operability of a particular computing node of the plurality of computing nodes.

A system comprising:

• a plurality of computing nodes including at least a first computing node operating as a broker computing node and at least a second computing node operating as an analytic computing node with a first cluster being a grouping of computing nodes;
• and
• a management system communicatively coupled to the plurality of computing nodes, the management system being configured to manage a formation of a cluster in response to detecting a first event and to manage a modification of the first cluster including at least the plurality of computing nodes in response to a second event,
• wherein at least the second event includes either (i) receipt of a message to join the cluster that prompts analysis of a workload for each cluster managed by the management system including the first cluster or (ii) detecting of a degradation in operability of a particular computing node of the plurality of computing nodes, and
• wherein in response to the second event corresponding to a takeover event, the management system (i) determines whether the plurality of computing nodes forming the first cluster include at least two computing nodes that operate as broker computing nodes, (ii) configures a third computing node to operate as a broker computing node to communicate with a first sensor for receiving the one or more suspicious objects when the plurality of computing nodes include at least two computing nodes are operating as broker computing nodes, or (iii) alter a configuration of one of the plurality of computing nodes other than the first computing node to operate as a broker computing node to communicate with the first sensor for receiving the suspicious object when the first computing node is a sole broker computing node for the first cluster.

A computerized method to ensure availability of a first plurality of computing nodes that collectively operate as a cluster and analyze suspicious objects received from one or more sensors for malware, comprising:

• responsive to detecting an event that identifies a degradation in operability of a first computing node of the first plurality of computing nodes that is operating as a broker computing node and is communicatively coupled to a first sensor of the one or more sensors, determining whether the first plurality of computing nodes includes a second plurality of computing nodes that are operating as broker computing nodes, the second plurality of computing nodes providing communication paths for submission of the suspicious objects from the one or more sensors to the cluster for malware analysis;
• responsive to determining that the first plurality of computing nodes includes the second plurality of computing nodes operating as broker computing nodes for the cluster, configuring a second computing node of the second plurality of computing nodes that is operating as a broker computing node to provide the first sensor with connectivity to the cluster;
• and
• responsive to determining that the cluster includes a single broker computing node being the first computing node, altering a configuration of a computing node of the first plurality of computing nodes operating as an analytic computing node to operate as a broker computing node, the computing node including an object analysis system that is configured to analyze suspicious objects for malware and an analysis coordination system that is deactivated when the computing node is operating as the analytic computing node and is activated when the computing node is operating as the broker computing node.

A non-transitory computer readable medium including software that, when executed by a hardware processor, performs operations comprising:

• detecting an event that identifies a degradation in operability of a first computing node of a first plurality of computing nodes forming a cluster, the first computing node operating as a broker computing node and being communicatively coupled to a first sensor of one or more sensors;
• responsive to detecting the event, determining whether the first plurality of computing nodes includes a second plurality of computing nodes that are operating as broker computing nodes that provide communication paths for submission of suspicious objects from the one or more sensors to the cluster for malware analysis;
• responsive to determining that the first plurality of computing nodes includes the second plurality of computing nodes operating as broker computing nodes for the cluster, configuring a second computing node of the second plurality of computing nodes that is operating as a broker computing node to provide the first sensor with connectivity to the cluster;
• and
• responsive to determining that the cluster includes a single broker computing node being the first computing node, altering a configuration of a computing node of the first plurality of computing nodes, operating as an analytic computing node, to operate as a broker computing node, wherein the analytic computing node including an object analysis system that is configured to analyze suspicious objects for malware and an analysis coordination system that is deactivated when the computing node is operating as an analytic computing node and is activated when the computing node is operating as the broker computing node,
• wherein each broker computing node including an object analysis system that is configured to analyze suspicious objects for malware and an analysis coordination system that is activated.

A system comprising:

• a plurality of computing nodes that collectively operate as a cluster and analyze a suspicious object for malware, the cluster includes a plurality of computing nodes including at least a first computing node and a second computing node;
• and
• a management system communicatively coupled to the plurality of computing nodes, the management system being configured to reassign operability of the second computing node from operating as an analytic computing node to operating as a broker computing node in response to an event,
• wherein the second computing node including an object analysis system that is configured to analyze the suspicious object for malware and an analysis coordination system that, when in operation, is configured to (i) establish communications with at least one sensor for receipt of the suspicious object by the cluster and (ii) make the suspicious object available to object analysis systems operating within the cluster including at least the object analysis system, and
• wherein the analysis coordination system of the second computing node being (i) activated when the second computing node is operating as a broker computing node or (ii) deactivated when the second computing node is operating as an analytic computing node.