# US 11,444,960 B2 · Stateful rule generation for behavior based threat detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,960 B2 - Document ID: US11444960B2 - Status: Granted - Kind: B2 - Application number: 16/718,183 - Filed: 2019-12-18 - Published: 2020-12-10 - Granted: 2022-09-13 - Earliest claimed: 2019-06-05 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Paul M. Drapeau; Kyle P. Gwinnup - Web page: https://patentgrep.com/patent/US11444960B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - B60W 60/0011: {involving control alternatives for a single driving scenario, e.g. planning several paths to avoid obstacles} - B60W 60/0018: {by employing degraded modes, e.g. reducing speed, in response to suboptimal conditions} - B60W 60/0025: {specially adapted for specific operations} - G06F 18/25: Fusion techniques - H04L 41/0894: Policy-based network configuration management - H04L 43/0817: by checking functioning - H04L 63/0263: {Rule management} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1433: {Vulnerability analysis} - H04L 43/16: Threshold monitoring - H04L 43/50: Testing arrangements - H04L 63/0254: {Stateful filtering} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - B60W: CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Improved tools and techniques for generating stateful rules for behavior-based threat detection enable threat analysts, who do not have advanced computer programming skills, to quickly and easily generate high-level representations of stateful behavioral rules, which are then compiled into a format suitable for execution by a stateful rule processing engine. In some examples, the high-level representations of stateful rules are coded in a high-level, domain specific language (DSL). The DSL may provide high-level primitives suitable for (1) expressing sequences of attack behaviors, (2) tagging computational entities (e.g., threads, processes, applications, systems, users, etc.) with states (e.g., user-defined states), and/or (3) performing operations on endpoint nodes (e.g., reporting activity, blocking activity, terminating processes, etc.). ## Claims ### Claim 1 A method of generating a stateful rule for behavior based threat detection, the method comprising: generating a high-level representation of the stateful rule, wherein the high-level representation is expressed in a domain-specific programming language (DSL); generating a compiled representation of the stateful rule by at least compiling the high-level representation of the stateful rule; loading the compiled representation of the stateful rule onto a rule processing engine of an endpoint node; determining, with the rule processing engine, whether a condition of the compiled representation of the stateful rule is satisfied, based at least on one or more events observed on the endpoint node or on a state of one or more computational entities; and based at least on determining that the condition of the compiled representation of the stateful rule is satisfied, performing an action specified by the compiled representation of the stateful rule, wherein the action specified by the compiled representation of the stateful rule comprises changing the state of the one or more computational entities or performing one or more operations on the endpoint node. ### Claim 2 (depends on 1) The method of claim 1, wherein the DSL provides primitives for identifying events observed on the endpoint node, tagging computational entities with states, and performing operations on the endpoint node. ### Claim 3 (depends on 1) The method of claim 1, further comprising: sensing an event with a sensor, wherein determining whether the condition of the compiled representation of the stateful rule is satisfied comprises, based at least on sensing the event by the sensor, determining whether the condition of the compiled representation of the stateful rule is satisfied. ### Claim 4 (depends on 3) The method of claim 3, wherein sensing the event with the sensor comprises capturing an event selected from the list consisting of: an incoming packet, an outgoing packet, an incoming message, on outgoing message, a pending operation, an in-process operation, and a completed operation. ### Claim 5 (depends on 1) The method of claim 1, further comprising: generating a compiled rule set by bundling the compiled representation of the stateful rule with compiled representations of at least one additional stateful rule, and wherein loading the compiled representation of the stateful rule onto the rule processing engine of the endpoint node comprises pushing the compiled rule set to the endpoint node. ### Claim 6 (depends on 1) The method of claim 1, further comprising: detecting new threat behavior with an automated threat analysis component. ### Claim 7 (depends on 1) The method of claim 1, wherein generating the high-level representation of the stateful rule comprises using a classification established in a prior stateful rule. ### Claim 8 A system for generating a stateful rule for behavior based threat detection, the system comprising: a processor; and a non-transitory computer readable medium having stored thereon program code, the program code causing the processor to: generate a high-level representation of the stateful rule, wherein the high-level representation is expressed in a domain-specific programming language (DSL); generate a compiled representation of the stateful rule by at least compiling the high-level representation of the stateful rule; load the compiled representation of the stateful rule onto a rule processing engine of an endpoint node; determine, with the rule processing engine, whether a condition of the compiled representation of the stateful rule is satisfied, based at least on one or more events observed on the endpoint node or on a state of one or more computational entities; and based at least on determining that the condition of the compiled representation of the stateful rule is satisfied, perform an action specified by the compiled representation of the stateful rule, wherein the action specified by the compiled representation of the stateful rule comprises changing the state of the one or more computational entities or performing one or more operations on the endpoint node. ### Claim 9 (depends on 8) The system of claim 8, wherein the DSL provides primitives for identifying events observed on the endpoint node, tagging computational entities with states, and performing operations on the endpoint node. ### Claim 10 (depends on 8) The system of claim 8, wherein the program code is further operative to: sense an event with a sensor, wherein determining whether the condition of the compiled representation of the stateful rule is satisfied comprises, based at least on sensing the event by the sensor, determining whether the condition of the compiled representation of the stateful rule is satisfied. ### Claim 11 (depends on 10) The system of claim 10, wherein sensing the event with the sensor comprises capturing an event selected from the list consisting of: an incoming packet, an outgoing packet, an incoming message, on outgoing message, a pending operation, an in-process operation, and a completed operation. ### Claim 12 (depends on 8) The system of claim 8, wherein the program code is further operative to: generate a compiled rule set by bundling the compiled representation of the stateful rule with compiled representations of at least one additional stateful rule, and wherein loading the compiled representation of the stateful rule onto the rule processing engine of the endpoint node comprises pushing the compiled rule set to the endpoint node. ### Claim 13 (depends on 8) The system of claim 8, wherein the program code is further operative to: detecting new threat behavior with an automated threat analysis component. ### Claim 14 (depends on 8) The system of claim 8, wherein generating the high-level representation of the stateful rule comprises using a classification established in a prior stateful rule. ### Claim 15 A non-transitory computer readable storage medium having stored thereon program code executable by a computer system, the program code embodying a method comprising: generating a high-level representation of a stateful rule, wherein the high-level representation is expressed in a domain-specific programming language (DSL); generating a compiled representation of the stateful rule by at least compiling the high-level representation of the stateful rule; loading the compiled representation of the stateful rule onto a rule processing engine of an endpoint node; determining, with the rule processing engine, whether a condition of the compiled representation of the stateful rule is satisfied, based at least on one or more events observed on the endpoint node or on a state of one or more computational entities; and based at least on determining that the condition of the compiled representation of the stateful rule is satisfied, performing an action specified by the compiled representation of the stateful rule, wherein the action specified by the compiled representation of the stateful rule comprises changing the state of the one or more computational entities or performing one or more operations on the endpoint node. ### Claim 16 (depends on 15) The non-transitory computer storage medium of claim 15, wherein the DSL provides primitives for identifying events observed on the endpoint node, tagging computational entities with states, and performing operations on the endpoint node. ### Claim 17 (depends on 15) The non-transitory computer storage medium of claim 15, wherein the method embodied by the program code further comprises: sensing an event with a sensor, wherein determining whether the condition of the compiled representation of the stateful rule is satisfied comprises, based at least on sensing the event by the sensor, determining whether the condition of the compiled representation of the stateful rule is satisfied. ### Claim 18 (depends on 17) The non-transitory computer storage medium of claim 17, wherein sensing the event with the sensor comprises capturing an event selected from the list consisting of: an incoming packet, an outgoing packet, an incoming message, on outgoing message, a pending operation, an in-process operation, and a completed operation. ### Claim 19 (depends on 15) The non-transitory computer storage medium of claim 15, wherein the method embodied by the program code further comprises: generating a compiled rule set by bundling the compiled representation of the stateful rule with compiled representations of at least one additional stateful rule, and wherein loading the compiled representation of the stateful rule onto the rule processing engine of the endpoint node comprises pushing the compiled rule set to the endpoint node. ### Claim 20 (depends on 15) The non-transitory computer storage medium of claim 15, wherein the method embodied by the program code further comprises: detecting new threat behavior with an automated threat analysis component.