Path-based program lineage inference analysis

A supervisory machine for securing an enterprise environment by detecting suspicious software, the supervisory machine being in electrical communication with one or more user machines, the supervisory machine comprising:

• a storage device configured to store program lineage data received from the one or more user machines, and a global program lineage graph;
• a processor operatively coupled to the storage device and configured to detecting suspicious software by executing program code, stored on the storage device, to:
• construct the global program lineage graph, the global program lineage graph including:
• a node for each version of a program installed on a set of user machines, the node including metadata including an event time associated with the respective version of the program, wherein the same version of the program installed on different user machines has the same node on the global lineage graph, the version of the program determined by an identifier unique to the version and program combination, each node being identified by a unique identifier, and a directional edge linking at least two nodes, the directional edge representing a progression from a first version of the program to a next version of the program based on the event time of each version of the program,
• determine, for each version of the program, a prevalence number of the set of user machines on which each version of the program had been installed and record the prevalence number to the metadata associated with the respective node, and
• identify anomalous behavior, indicative of a suspicious software, based on structures formed by the at least two nodes and associated directional edge in the global program lineage graph;
• and
• a display screen having a graphical user interface implemented by the processor and displayed on the display screen, the graphical user interface configured to present an alarm for the suspicious software indicated by the identified anomalous behavior.

A computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method for securing an enterprise environment by detecting suspicious software, comprising:

• constructing a global program lineage graph comprising:
• creating a node for each version of a program installed on a set of user machines, the node including metadata including an event time associated with the respective version of the program, each node being identified by a unique identifier, wherein the same version of the program installed on different user machines has the same node on the global lineage graph, the version of the program determined by an identifier unique to the version and program combination,
• linking at least two nodes with a directional edge, the directional edge representing a progression from a first version of the program to a next version of the program based on the event time of each version of the program, and
• determining, for each version of the program, a prevalence number of the set of user machines on which each version of the program had been installed and recording the prevalence number to the metadata associated with the respective node;
• identifying anomalous behavior, indicative of a suspicious software, based on structures formed by the at least two nodes and associated directional edge in the global program lineage graph;
• and
• displaying an alarm on a graphical user interface for the suspicious software indicated by the identified anomalous behavior;
• for the suspicious software indicated by the identified anomalous behavior.