Method and system for application virtualization that includes machine learning

A system for running an application via an operating system executing on a computing device, the system comprising:

• at least one processing unit and memory;
• an operating system stored on the memory;
• and
• a container stored on memory, the container including an application and a user-level application virtualization layer;
• wherein execution of the application and the user-level application virtualization layer on the operating system involves;
• executing the application in user-space of a stateless computing environment;
• executing the user-level virtualization layer in the user-space of the stateless computing environment, the user-level virtualization layer including a set of rules;
• performing, via the user-level virtualization layer, user-level hooking of events that are generated by the executing application according to the set of rules to identify events of interest;
• storing events, which are identified from the user-level hooking at the user-level virtualization layer as events of interest, in a machine learning patterns database that is maintained at the user-level virtualization layer of the stateless computing environment;
• applying, at the user-level virtualization layer, a pattern recognition process to the events that are stored in the machine learning patterns database that is maintained at the user-level virtualization layer of the stateless computing environment;
• generating, at the user-level virtualization layer, a new rule based on the pattern recognition process and adding the new rule to the set of rules for use in the user-level virtualization layer;
• and
• applying, through the user-level virtualization layer, the set of rules, including the new rule that has been added to the set of rules, to subsequent events that are generated by the executing application;
• wherein the pattern recognition process involves;
• generating a training set while executing the application in a controlled environment that is free from malicious activity;
• storing the training set in the machine learning patterns database that is maintained at the user-level virtualization layer of the stateless computing environment;
• determining that a hooked event has not been seen before relative to the training set;
• and
• wherein generating a new rule based on the pattern recognition process involves generating a new rule in response to determining that a hooked event has not been seen before relative to the training set.

A non-transitory computer readable medium that stores computer-executable code, the computer-executable code comprising:

• a container that includes an application and a user-level virtualization layer;
• the application and user-level virtualization layer comprising computer-executable code, which when executed by one or more processors performs:
• executing the application in user-space of a stateless computing environment;
• executing the user-level virtualization layer in the user-space of the stateless computing environment, the user-level virtualization layer including a set of rules;
• performing, via the user-level virtualization layer, user-level hooking of events that are generated by the executing application according to the set of rules to identify events of interest;
• storing events, which are identified from the user-level hooking at the user-level virtualization layer as events of interest, in a machine learning patterns database that is maintained at the user-level virtualization layer of the stateless computing environment;
• applying, at the user-level virtualization layer, a pattern recognition process to the events that are stored in the machine learning patterns database that is maintained at the user-level virtualization layer of the stateless computing environment;
• generating, at the user-level virtualization layer, a new rule based on the pattern recognition process and adding the new rule to the set of rules for use in the user-level virtualization layer;
• and
• applying, through the user-level virtualization layer, the set of rules, including the new rule that has been added to the set of rules, to subsequent events that are generated by the executing application;
• wherein the pattern recognition process involves;
• generating a training set while executing the application in a controlled environment that is free from malicious activity;
• storing the training set in the machine learning patterns database that is maintained at the user-level virtualization layer of the stateless computing environment;
• determining that a hooked event has not been seen before relative to the training set;
• and
• wherein generating a new rule based on the pattern recognition process involves generating a new rule in response to determining that a hooked event has not been seen before relative to the training set.