# US 10,503,536 B2 · Collecting and storing threat level indicators for service rule processing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,536 B2 - Document ID: US10503536B2 - Status: Granted - Kind: B2 - Application number: 15/650,340 - Filed: 2017-07-14 - Published: 2018-06-28 - Granted: 2019-12-10 - Earliest claimed: 2016-12-22 - Assignees: Nicira, Inc. - Applicants: Nicira, Inc. - Inventors: Laxmikant Vithal Gunda - Web page: https://patentgrep.com/patent/US10503536B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/06: using stored programs, i.e. using an internal store of processing equipment to receive or retain programs - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 51/214: using selective forwarding - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/0254: {Stateful filtering} - H04L 63/0263: {Rule management} - H04L 63/0281: {Proxies} - H04L 63/0471: {applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F 2221/2105: Dual mode as a secondary aspect - H04L 51/212: using filtering or selective blocking - H04L 61/103: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP] - H04L 61/2521: Translation architectures other than single NAT servers - H04L 61/2596: Translation of addresses of the same type other than IP, e.g. translation from MAC to MAC addresses - H04L 61/5014: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP] - H04L 61/59: using proxies for addressing - H04L 63/1433: {Vulnerability analysis} - H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Some embodiments of the invention provide a novel architecture for capturing contextual attributes on host computers that execute one or more machines, and for consuming the captured contextual attributes to perform services on the host computers. The machines are virtual machines (VMs) in some embodiments, containers in other embodiments, or a mix of VMs and containers in still other embodiments. Some embodiments execute a guest-introspection (GI) agent on each machine from which contextual attributes need to be captured. In addition to executing one or more machines on each host computer, these embodiments also execute a context engine and one or more attribute-based service engines on each host computer. Through the GI agents of the machines on a host, the context engine of that host in some embodiments collects contextual attributes associated with network events and/or process events on the machines. The context engine then provides the contextual attributes to the service engines, which, in turn, use these contextual attributes to identify service rules for processing. ## Claims ### Claim 1 A method of performing services on a host computer that executes a plurality of machines, the plurality of machines including a first machine, the method comprising: at a process-control module executing on the host computer, receiving a process identifier identifying a first process executing on the first machine and associated with a first application executing on the first machine; using the received process identifier to query the first machine to obtain one or more additional process identifiers of the first process, wherein the one or more additional process identifiers include at least one of a process hash and an application name, providing at least one of the additional process identifiers to a threat detector executing on the host computer to obtain a threat-level indicator for the first process, wherein the threat level indicator is a threat score that is based on a set of one or more behavioral factors associated with the first application; in a storage on the host computer, storing the threat level indicator for a data message flow emanating from the first process in order to process attribute-based service rules that a service engine on the host computer enforces for said data message flow. ### Claim 2 (depends on 1) The method of claim 1, wherein the process-control module and the threat detector operate outside of the first machine. ### Claim 3 (depends on 1) The method of claim 1, wherein the set of behavioral factors includes two or more of the following: how the first application validates inputs, how the first application authenticates credentials, how the first application stores configuration secrets, how the first application transfers files, how the first application specifies password policies, and how the first application specifies account policies. ### Claim 4 (depends on 3) The method of claim 3, wherein the application behavioral factors further includes whether the application is known to propagate malware or is known to have vulnerabilities. ### Claim 5 (depends on 1) The method of claim 1 further comprising receiving a notification that the first process has started on the first machine. ### Claim 6 (depends on 1) The method of claim 1 further comprising determining that a data message has been sent by the first process. ### Claim 7 A method of performing services on a host computer that executes a plurality of machines, the plurality of machines including a first machine, the method comprising: at a process-control module executing on the host computer, receiving a set of one or more process identifiers identifying a first process executing on the first machine; providing at least one process identifier in the received set to a threat detector executing on the host computer to obtain a threat level indicator for the first process; in a storage on the host computer, storing the threat level indicator for a data message flow emanating from the first process in order to process attribute-based service rules that a service engine on the host computer enforces for said data message flow; and retrieving the threat-level indicator from the storage and providing the threat level indicator to the service engine in order to allow the service engine to perform a service operation on a data message emanating from the first process, wherein the service engine (1) compares the threat level indicator and one or more header values of the data message with service rule identifiers of service rules stored in a service rule storage, in order to identify a service rule with a rule identifier that matches the threat level indicator and the one or more header values, and (2) performs the service operation based on the identified service rule. ### Claim 8 (depends on 7) The method of claim 7 further comprising receiving a notification that the first process has started on the first machine. ### Claim 9 (depends on 7) The method of claim 7 further comprising determining that a data message has been sent by the first process. ### Claim 10 A non-transitory machine readable medium storing a program for performing services on a host computer that executes a plurality of machines, the plurality of machines including a first machine, the program comprising sets of instructions for: receiving a process identifier identifying a first process executing on the first machine and associated with a first application executing on the first machine; using the received process identifier to query the first machine to obtain one or more additional process identifiers of the first process, wherein the one or more additional process identifiers include at least one of a process hash and an application name; providing at least one of the additional process identifiers to a threat detector executing on the host computer to obtain a threat-level indicator for the first process, wherein the threat level indicator is a threat score that is based on a set of one or more behavioral factors associated with the first application; in a storage on the host computer, storing the threat level indicator for a data message flow emanating from the first process in order to process attribute-based service rules that a service engine on the host computer enforces for said data message flow. ### Claim 11 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the threat detector operates outside of the first machine. ### Claim 12 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the set of behavioral factors includes two or more of the following: how the first application validates inputs, how the first application authenticates credentials, how the first application stores configuration secrets, how the first application transfers files, how the first application specifies password policies, and how the first application specifies account policies. ### Claim 13 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the application behavioral factors further includes whether the application is known to propagate malware or is known to have vulnerabilities. ### Claim 14 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the program further comprises a set of instructions for receiving a notification that the first process has started on the first machine. ### Claim 15 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the program further comprises a set of instructions for determining that a data message has been sent by the first process. ### Claim 16 A non-transitory machine readable medium storing a program for performing services on a host computer that executes a plurality of machines, the plurality of machines including a first machine, the program comprising sets of instructions for: receiving a set of one or more process identifiers identifying a first process executing on the first machine; providing at least one process identifier in the received set to a threat detector executing on the host computer to obtain a threat level indicator for the first process; in a storage on the host computer, storing the threat level indicator for a data message flow emanating from the first process in order to process attribute-based service rules that a service engine on the host computer enforces for said data message flow; and retrieving the threat-level indicator from the storage and providing the threat level indicator to the service engine in order to allow the service engine to perform a service operation on a data message emanating from the first process, wherein the service engine (1) compares the threat level indicator and one or more header values of the data message with service rule identifiers of service rules stored in a service rule storage, in order to identify a service rule with a rule identifier that matches the threat level indicator and the one or more header values, and (2) performs the service operation based on the identified service rule. ### Claim 17 (depends on 16) The non-transitory machine readable medium of claim 16, wherein the program further comprises a set of instructions for receiving a notification that the first process has started on the first machine. ### Claim 18 (depends on 16) The non-transitory machine readable medium of claim 16, wherein the program further comprises a set of instructions for determining that a data message has been sent by the first process.