Interactive shell event detection
AssigneeCapsule8, Inc.
InventorBrandon M. Edwards
Life of this patent
Estimating the term…
Abstract
Telemetry associated with a system call denoting that a program has been invoked via a process is received. A determination is made that the invoked process is a shell. Subsequent to determining that the invoked program is a shell, additional information comprising at least one of a determination that the program has attempted to obtain terminal information, and keystroke timing information is received. Based at least in part on the received additional information, a determination is made that the program is an interactive shell. In response to determining that the program is an interactive shell, an action is taken.
Claims25
A system, comprising:
- a processor configured to:
- receive telemetry associated with a system call denoting that a program has been invoked via a process;
- determine that the program invoked via the process is a shell program;
- subsequent to determining that the invoked program is a shell program, determine that the shell program is being interacted with directly by a human user instead of programmatically and tag the shell program as an interactive shell program based at least in part on determining that keystrokes were provided by a human instead of being programmatically provided by a script;
- associate keystroke timing information with a specific user;
- and
- in response to determining that the program is an interactive shell program, transmit an out-of-band query to the specific user to determine whether the specific user provided the keystrokes;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- receiving telemetry associated with a system call denoting that a program has been invoked via a process;
- determining that the program invoked via the process is a shell program;
- subsequent to determining that the invoked program is a shell program, determining that the shell program is being interacted with directly by a human user instead of programmatically and tag the shell program as an interactive shell program based at least in part on determining that keystrokes were provided by a human instead of being programmatically provided by a script;
- associating keystroke timing information with a specific user;
- and
- in response to determining that the program is an interactive shell program, transmitting an out-of-band query to the specific user to determine whether the specific user provided the keystrokes.
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- receiving telemetry associated with a system call denoting that a program has been invoked via a process;
- determining that the program invoked via the process is a shell program;
- subsequent to determining that the invoked program is a shell program, determining that the shell program is being interacted with directly by a human user instead of programmatically and tag the shell program as an interactive shell program based at least in part determining that keystrokes were provided by a human instead of being programmatically provided by a script;
- associating keystroke timing information with a specific user;
- in response to determining that the program is an interactive shell program, transmitting an out-of-band query to a specific user to determine whether the specific user provided the keystrokes.
Dependencies are inferred from the claim text.