US 11,775,640 B1Granted

Resource utilization-based malicious task detection in an on-demand code execution system

AssigneeAmazon Technologies, Inc.

InventorsMihir Sathe, Niall Mullen

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods are described for detecting and preventing execution of malware on an on-demand code execution system. An on-demand code execution system may execute user-submitted code on virtual machine instances, which may be provisioned with various computing resources (memory, storage, processors, network bandwidth, etc.). These resources may be utilized in varying amounts or at varying rates during execution of the user-submitted code. The user-submitted code may also be unavailable for inspection for security or other reasons. A malware detection system may thus identify user-submitted code that corresponds to malware by monitoring resource utilization during execution of the code and generating a resource utilization signature, which enables comparison between the signature of the user-submitted code and resource utilization signatures of codes previously identified as malware. The malware detection system may then take actions such as notifying the user who requested execution or preventing execution of the user-submitted code.

Claims19

Dependent claims

A system for detecting execution of malicious tasks in an on-demand code execution system, the system comprising:

a data store configured to store computer-executable instructions;
and
a processor in communication with the data store, wherein the computer-executable instructions, when executed by the processor, configure the processor to perform operations including:
receiving a request to execute a user-submitted task on an on-demand code execution system, wherein the user-submitted task is associated with a user account of the on-demand code execution system;
monitoring utilization of computing resources during execution of the user-submitted task;
generating, based at least in part on the monitored utilization of the computing resources during the execution of the user-submitted task, a resource utilization signature for the user-submitted task, wherein the resource utilization signature is generated without reference to code associated with the user-submitted task;
obtaining, a plurality of resource utilization signatures for previously executed tasks, wherein at least one resource utilization signature of the plurality of resource utilization signatures is associated with a malicious task;
determining that the resource utilization signature for the user-submitted task corresponds to the at least one resource utilization signature associated with the malicious task;
in response to the determination, generating a notification regarding the resource utilization signature for the user-submitted task;
and
transmitting the notification to a user computing device associated with the user account.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/835,166Filed 30 Mar 2020
Granted: 3 Oct 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 21/566
Computer malware detection or handling, e.g. anti-virus arrangements: dynamic detection, i.e. detection performed at run-time, e.g. emulation,…
G06F 21/54
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by adding security routines or objects to programs
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection