US 11,444,960 B2 · Stateful rule generation for behavior based threat detection

Abstract

Improved tools and techniques for generating stateful rules for behavior-based threat detection enable threat analysts, who do not have advanced computer programming skills, to quickly and easily generate high-level representations of stateful behavioral rules, which are then compiled into a format suitable for execution by a stateful rule processing engine. In some examples, the high-level representations of stateful rules are coded in a high-level, domain specific language (DSL). The DSL may provide high-level primitives suitable for (1) expressing sequences of attack behaviors, (2) tagging computational entities (e.g., threads, processes, applications, systems, users, etc.) with states (e.g., user-defined states), and/or (3) performing operations on endpoint nodes (e.g., reporting activity, blocking activity, terminating processes, etc.).

Claims20

Dependent claims

A method of generating a stateful rule for behavior based threat detection, the method comprising:

generating a high-level representation of the stateful rule, wherein the high-level representation is expressed in a domain-specific programming language (DSL);
generating a compiled representation of the stateful rule by at least compiling the high-level representation of the stateful rule;
loading the compiled representation of the stateful rule onto a rule processing engine of an endpoint node;
determining, with the rule processing engine, whether a condition of the compiled representation of the stateful rule is satisfied, based at least on one or more events observed on the endpoint node or on a state of one or more computational entities;
and
based at least on determining that the condition of the compiled representation of the stateful rule is satisfied, performing an action specified by the compiled representation of the stateful rule, wherein the action specified by the compiled representation of the stateful rule comprises changing the state of the one or more computational entities or performing one or more operations on the endpoint node.

3 more elements

A system for generating a stateful rule for behavior based threat detection, the system comprising:

a processor;
and
a non-transitory computer readable medium having stored thereon program code, the program code causing the processor to:
generate a high-level representation of the stateful rule, wherein the high-level representation is expressed in a domain-specific programming language (DSL);
generate a compiled representation of the stateful rule by at least compiling the high-level representation of the stateful rule;
load the compiled representation of the stateful rule onto a rule processing engine of an endpoint node;
determine, with the rule processing engine, whether a condition of the compiled representation of the stateful rule is satisfied, based at least on one or more events observed on the endpoint node or on a state of one or more computational entities;
and
based at least on determining that the condition of the compiled representation of the stateful rule is satisfied, perform an action specified by the compiled representation of the stateful rule, wherein the action specified by the compiled representation of the stateful rule comprises changing the state of the one or more computational entities or performing one or more operations on the endpoint node.

6 more elements

A non-transitory computer readable storage medium having stored thereon program code executable by a computer system, the program code embodying a method comprising:

generating a high-level representation of a stateful rule, wherein the high-level representation is expressed in a domain-specific programming language (DSL);
generating a compiled representation of the stateful rule by at least compiling the high-level representation of the stateful rule;
loading the compiled representation of the stateful rule onto a rule processing engine of an endpoint node;
determining, with the rule processing engine, whether a condition of the compiled representation of the stateful rule is satisfied, based at least on one or more events observed on the endpoint node or on a state of one or more computational entities;
and
based at least on determining that the condition of the compiled representation of the stateful rule is satisfied, performing an action specified by the compiled representation of the stateful rule, wherein the action specified by the compiled representation of the stateful rule comprises changing the state of the one or more computational entities or performing one or more operations on the endpoint node.

3 more elements

Dependencies are inferred from the claim text.

Stateful rule generation for behavior based threat detection

Life of this patent

Stateful rule generation for behavior based threat detection

Life of this patent

Abstract

Claims20