System and method for automatically adjusting the learning mode duration on a virtual computing instance for an application security system based on its workload activities
AssigneeVMware, Inc.
InventorsShirish Vijayvargiya, Sunil Hasbe
Life of this patent
Estimating the term…
Abstract
A system and method for automatically adjusting a learning mode duration on a virtual computing instance for an application security system extends a minimum duration of time for the learning mode duration for a guest agent running in the virtual computing instance based on a condition with respect to suspicious activities and deviations from normal behaviors detected during a fixed time interval. The guest agent is switched to a protected mode when the condition with respect to the suspicious activities and the deviations from the normal behaviors is satisfied for any fixed time interval after the minimum duration of time.
Claims20
A computer-implemented method for automatically adjusting a learning mode duration on a virtual computing instance for an application security system, the method comprising:
- enabling a guest agent of an application security system running in the virtual computing instance to operate in a learning mode for a minimum duration of time so that the learning mode duration is at least the minimum duration of time;
- during the minimum duration of time, monitoring behaviors of the virtual computing instance by the guest agent to determine normal behaviors of the virtual computing instance;
- after the expiration of the minimum duration of time, monitoring the virtual computing instance for a fixed time interval by the guest agent for suspicious activities and deviations from the normal behaviors;
- when a condition with respect to the suspicious activities and the deviations from the normal behaviors is not satisfied, extending the learning mode duration on the virtual computing instance by an additional duration of time;
- and
- after the additional duration of time, switching the guest agent to a protected mode when the condition with respect to the suspicious activities and the deviations from the normal behaviors is satisfied for any fixed time interval.
A non-transitory computer-readable storage medium containing program instructions for method for automatically adjusting a learning mode duration on a virtual computing instance for an application security system, wherein execution of the program instructions by one or more processors of a computer system causes the one or more processors to perform steps comprising:
- enabling a guest agent of the application security system running in the virtual computing instance to operate in a learning mode for a minimum duration of time so that the learning mode duration is at least the minimum duration of time;
- during the minimum duration of time, monitoring behaviors of the virtual computing instance by the guest agent to determine normal behaviors of the virtual computing instance;
- after the expiration of the minimum duration of time, monitoring the virtual computing instance for a fixed time interval by the guest agent for suspicious activities and deviations from the normal behaviors;
- when a condition with respect to the suspicious activities and the deviations from the normal behaviors is not satisfied, extending the learning mode duration on the virtual computing instance by an additional duration of time;
- and
- after the additional duration of time, switching the guest agent to a protected mode when the condition with respect to the suspicious activities and the deviations from the normal behaviors is satisfied for any fixed time interval.
A system comprising:
- memory;
- and
- at least one processor configured to:
- enable a guest agent running in a virtual computing instance to operate in a learning mode for a minimum duration of time so that a learning mode duration on the virtual computing instance is at least the minimum duration of time;
- during the minimum duration of time, monitor behaviors of the virtual computing instance by the guest agent to determine normal behaviors of the virtual computing instance;
- after the expiration of the minimum duration of time, monitor the virtual computing instance for a fixed time interval by the guest agent for suspicious activities and deviations from the normal behaviors;
- when a condition with respect to the suspicious activities and the deviations from the normal behaviors is not satisfied, extend the learning mode duration on the virtual computing instance by an additional duration of time;
- and
- after the additional duration of time, switching the guest agent to a protected mode when the condition with respect to the suspicious activities and the deviations from the normal behaviors is satisfied for any fixed time interval.
Dependencies are inferred from the claim text.