Inter-application dependency analysis for improving computer system threat detection

A computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method for improving threat detection in a computer system by performing an inter-application dependency analysis on events of the computer system, the method comprising:

• receiving a Tracking Description Language (TDL) query for performing a tracking analysis, the TDL query including general constraints for performing the tracking analysis, a tracking declaration specifying at least events of the computer system to be analyzed, and an output specification specifying a location for storing a tracking graph generated by the tracking analysis;
• parsing the TDL query using a language parser;
• executing the tracking analysis based on the parsed TDL query, including implementing a progressive tracking method to generate a result of the tracking analysis by:
• splitting dependents of a given one of the events of the computer system into a plurality of execution windows with each of the execution windows being defined as a 3-tuple<begin, finish, e>, where begin is a starting time point, finish is an ending time point, and e is an event of interest, wherein the events of the computer system are used as edges in the tracking graph;
• enumerating all events occurring in each of the execution windows;
• and
• prioritizing the plurality of execution windows based on their respective ending time points;
• generating a tracking graph by cleaning the result of the tracking analysis, including removing all nodes that fail to meet constraints of the TDL query;
• and
• outputting, via an interface, query results based on the tracking graph, the query results including at least one of the tracking graph and an optimized version of the tracking graph.

A computer-implemented method for improving threat detection in a computer system by performing an inter-application dependency analysis on events of the computer system, comprising:

• receiving, by a processor operatively coupled to a memory, a Tracking Description Language (TDL) query for performing a tracking analysis, the TDL query including general constraints for performing the tracking analysis, a tracking declaration specifying at least events of the computer system to be analyzed, and an output specification specifying a location for storing a tracking graph generated by the tracking analysis;
• parsing, by the processor, the TDL query using a language parser;
• executing, by the processor, the tracking analysis based on the parsed TDL query, including implementing a progressive tracking method to generate a result of the tracking analysis by:
• splitting dependents of a given one of the events of the computer system into a plurality of execution windows with each of the execution windows being defined as a 3-tuple<begin, finish, e), where begin is a starting time point, finish is an ending time point, and e is an event of interest, wherein the events of the computer system are used as edges in the tracking graph;
• enumerating all events occurring in each of the execution windows;
• and
• prioritizing the plurality of execution windows based on their respective ending time points;
• generating, by the processor, a tracking graph by cleaning the result of the tracking analysis, including removing all nodes that fail to meet constraints of the TDL query;
• and
• outputting, by the processor and via an interface, query results based on the tracking graph, the query results including at least one of the tracking graph and an optimized version of the tracking graph.