Back to results
US 11,886,600 B2Granted
Testing instrumentation for intrusion remediation actions
AssigneeMicrosoft Technology Licensing, LLC
InventorsKevin Lo, Daiqian Hu, Hongquan Yin, Lei He
Life of this patent
Estimating the term…
Abstract
A set of high level test logic is configured to include a set of insertion points. The high-level test logic can be controlled to insert test conditions into a data center configuration. It can also be configured to execute remediation actions that are to be taken, and validation actions to be performed in order to determine whether the remediation action works against the test conditions. Different instances of the high-level test logic can be configured for different environments and different test conditions.
Claims19
A computing system comprising:
- a malicious activity detection system configured to detect malicious activity representing an unauthorized user access in an execution environment;
- a remediation action execution system configured to execute an intrusion remediation action in the execution environment in response to detection of the malicious activity;
- and
- a remediation validation system configured to:
- automatically generate, based on a scheduling criterion, an isolated computing environment that
- includes at least one machine selected from a plurality of machines in the execution environment based on a selection criterion, and
- is isolated from the execution environment in which the malicious activity detection system is configured to detect the malicious activity,
- set a test condition in the isolated computing environment, the test condition representing the malicious activity,
- execute the intrusion remediation action in the isolated computing environment,
- generate an efficacy indicator that indicates a remediation action efficacy based on execution of the intrusion remediation action in the isolated computing environment, and
- generate an indication of a remediation action validation based on the efficacy indicator.
8 more elements
A computer-implemented method comprising:
- detecting malicious activity representing an unauthorized user access in an execution environment;
- executing an intrusion remediation action in the execution environment in response to detection of the malicious activity;
- automatically generating, based on a scheduling criterion, an isolated computing environment that
- includes at least one machine selected from a plurality of machines in the execution environment based on a selection criterion, and
- is isolated from the execution environment;
- setting a test condition in the isolated computing environment, the test condition representing the malicious activity;
- executing the intrusion remediation action in the isolated computing environment,
- generating an efficacy indicator that indicates a remediation action efficacy based on execution of the intrusion remediation action in the isolated computing environment, and
- generating an indication of a remediation action validation based on the efficacy indicator.
6 more elements
A computing system comprising:
- at least one processor;
- and
- memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:
- detect malicious activity representing an unauthorized user access in an execution environment;
- execute an intrusion remediation action in the execution environment in response to detection of the malicious activity;
- automatically generate, based on a scheduling criterion, an isolated computing environment that
- includes at least one machine selected from a plurality of machines in the computing system based on a selection criterion, and
- is isolated from the execution environment;
- set a test condition in the isolated computing environment, the test condition representing the malicious activity;
- execute the intrusion remediation action in the isolated computing environment,
- generate an efficacy indicator that indicates a remediation action efficacy based on execution of the intrusion remediation action in the isolated computing environment, and
- generate an indication of a remediation action validation based on the efficacy indicator.
9 more elements
Dependencies are inferred from the claim text.