Threat detection using artifact change analysis
AssigneeSap SE
InventorsRobert Lorch, Frederik Thormaehlen
Life of this patent
Estimating the term…
Abstract
Disclosed herein are system, method, and computer program product embodiments for performing threat detection on a monitored system. The monitored system may periodically send artifacts (e.g., database records, binaries, program code, business data) to a repository for storage and creation of a snapshot. This repository is typically held in a cloud-based system. The cloud-based system can compare a snapshot of the artifacts against prior snapshots, and generate a change log. This change log can then be provided to a threat detection system for analysis. By this approach, an intrusion can potentially be detected even when system logs cannot be trusted, due to tampering or other inaccuracies.
Claims18
A computer implemented method, comprising:
- storing, by a cloud-based system, an artifact in a repository of the cloud-based system remote from a system monitored for a threat, wherein the artifact is received by the cloud-based system from the system monitored for the threat;
- generating, by the cloud-based system, a change log responsive to receipt of the artifact by comparing a snapshot of the artifact to an earlier snapshot of the artifact previously created by the cloud-based system;
- determining that the cloud-based system has access to one or more log files including changes to data that occurred on the system monitored for the threat;
- identifying a change based on the change log generated by the cloud-based system;
- comparing the identified change of the change log to one or more entries in the one or more log files;
- determining that there is no entry in the one or more log files corresponding to the identified change;
- detecting a threat based on the determination that there is no corresponding entry in the one or more log files for the identified change;
- and
- issuing an alarm based on the detection of the threat that there is no corresponding entry in the one or more log files for the identified change of the change log.
A cloud-based system, comprising:
- a repository;
- a memory;
- and
- at least one processor coupled to the memory and configured to perform operations comprising:
- storing an artifact in the repository remote from a system monitored for a threat, wherein the artifact is received from the system monitored for the threat;
- generating a change log responsive to receipt of the artifact by comparing a snapshot of the artifact to an earlier snapshot of the artifact previously created by the cloud-based system;
- determining that the cloud-based system has access to one or more log files including changes to data that occurred on the system monitored for the threat;
- identifying a change based on the change log generated by the cloud-based system;
- comparing the identified change of the change log to one or more entries in the one or more log files;
- determining that there is no entry in the one or more log files corresponding to the identified change;
- detecting a threat based on the determination that there is no corresponding entry in the one or more log files for the identified change;
- and
- issuing an alarm based on the detection of the threat that there is no corresponding entry in the one or more log files for the identified change of the change log.
A non-transitory computer-readable device having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:
- storing, by a cloud-based system, an artifact in a repository of the cloud-based system remote from a system monitored for a threat, wherein the artifact is received from the system monitored for the threat;
- generating, by the cloud-based system, a change log responsive to receipt of the artifact by comparing a snapshot of the artifact to an earlier snapshot of the artifact previously created by the cloud-based system;
- determining that the cloud-based system has access to one or more log files including changes to data that occurred on the system monitored for the threat;
- identifying a change based on the change log generated by the cloud-based system;
- comparing the identified change of the change log to one or more entries in the one or more log files;
- determining that there is no entry in the one or more log files corresponding to the identified change;
- detecting a threat based on the determination that there is no corresponding entry in the one or more log files for the identified change;
- and
- issuing an alarm based on the detection of the threat that there is no corresponding entry in the one or more log files for the identified change of the change log.
Dependencies are inferred from the claim text.