# US 12,010,126 B2 · Method and system for automatically curating intrusion detection signatures for workloads based on contextual attributes in an SDDC > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,126 B2 - Document ID: US12010126B2 - Status: Granted - Kind: B2 - Application number: 17/374,630 - Filed: 2021-07-13 - Published: 2023-01-19 - Granted: 2024-06-11 - Earliest claimed: 2021-07-13 - Assignees: VMware, Inc. - Applicants: VMware LLC - Inventors: Nafisa Mandliwala; Sirisha Myneni; Subrahmanyam Manuguri - Web page: https://patentgrep.com/patent/US12010126B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/554: {involving event detection and direct action} - H04L 63/102: {Entity profiles} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Some embodiments of the invention provide a method of implementing an intent-based intrusion detection and prevention system in a datacenter that includes at least one host computer executing multiple machines. The method receives multiple contextual attributes associated with a set of data messages processed by the multiple machines executing on the at least one host computer, the multiple contextual attributes including contextual attributes that are not L2-L4 attributes and that define a compute environment in which one or more workloads performed by the multiple machines executing on the at least one host computer operate. The method uses the received multiple contextual attributes to perform a filtering operation to identify, from multiple intrusion detection signatures, a set of intrusion detection signatures applicable to the one or more workloads. The method provides the identified set of intrusion detection signatures to an intrusion detection system operating on the particular host computer for enforcement. ## Claims ### Claim 1 A method of implementing an intent-based intrusion detection and prevention system in a datacenter, the datacenter comprising at least one host computer executing a plurality of machines, the method comprising: receiving a plurality of contextual attributes associated with a set of data messages processed by the plurality of machines executing on the at least one host computer, the plurality of contextual attributes comprising contextual attributes that are not layer 2 through layer 4 attributes and that define a compute environment in which one or more workloads performed by the plurality of machines executing on the at least one host computer operate, wherein the plurality of contextual attributes is associated with a user intent; using the received plurality of contextual attributes to perform a filtering operation to identify, from a plurality of intrusion detection signatures, a set of intrusion detection signatures applicable to the one or more workloads; and providing the identified set of intrusion detection signatures to an intrusion detection system operating on the particular host computer for enforcement. ### Claim 2 (depends on 1) The method of claim 1, wherein the filtering operation further comprises comparing contextual attributes in the plurality of contextual attributes with contextual attributes specified by intrusion detection signatures in the plurality of intrusion detection signatures. ### Claim 3 (depends on 2) The method of claim 2, wherein each intrusion detection signature comprises a collection of bits in a bit pattern, each bit having a corresponding contextual attribute. ### Claim 4 (depends on 1) The method of claim 1, wherein the plurality of intrusion detection signatures comprises (i) a first set of intrusion detection signatures collected from the at least one host computer and (ii) a second set of intrusion detection signatures collected from third-party sources in the datacenter, the third-party sources comprising sources external to the at least one host computer in the datacenter. ### Claim 5 (depends on 1) The method of claim 1, wherein after receiving the plurality of contextual attributes, the method further comprises providing the plurality of contextual attributes and the plurality of intrusion detection signatures to a user for enabling the user to select (i) specific workloads identified based on the plurality of contextual attributes, and (ii) sets of intrusion detection rules to apply to the specific workloads. ### Claim 6 (depends on 5) The method of claim 5, wherein only a first subset of the identified set of intrusion detection signatures comprises intrusion detection signatures identified by the filtering operation, wherein a second subset of the identified set of intrusion detection signatures comprises intrusion detection signatures selected by the user for workloads performed by the plurality of machines. ### Claim 7 (depends on 1) The method of claim 1, wherein the identified set of intrusion detection signatures comprises intrusion detection signatures for detecting (i) anomalous user behavior and (ii) anomalous data message traffic behavior. ### Claim 8 (depends on 1) He method of claim 1, wherein the identified set of intrusion detection signatures are for managing resource access and resource usage on the at least one host computer. ### Claim 9 (depends on 1) The method of claim 1, wherein the intrusion detection system operating on the host computer is configured to use the identified set of intrusion detection signatures to detect intrusion detection events that indicate potential threats. ### Claim 10 (depends on 1) The method of claim 1, wherein the method is performed by a set of servers that implement an intrusion detection system framework for the datacenter. ### Claim 11 (depends on 1) The method of claim 1, wherein performing the filtering operation to identify the set of intrusion detection signatures further comprises filtering out intrusion detection signatures in the plurality of intrusion detection signatures that are not applicable to the one or more workloads, wherein the identified set of intrusion detection signatures comprises intrusion detection signatures that remain after the filtering operation is complete. ### Claim 12 A non-transitory machine readable medium storing a program for execution by a set of processing units, the program for implementing an intent-based intrusion detection and prevention system in a datacenter, the datacenter comprising at least one host computer executing a plurality of machines, the program comprising sets of instructions for: receiving a plurality of contextual attributes associated with a set of data messages processed by the plurality of machines executing on the at least one host computer, the plurality of contextual attributes comprising contextual attributes that are not layer 2 through layer 4 attributes and that define a compute environment in which one or more workloads performed by the plurality of machines executing on the at least one host computer operate, wherein the plurality of contextual attributes is associated with a user intent; using the received plurality of contextual attributes to perform a filtering operation to identify, from a plurality of intrusion detection signatures, a set of intrusion detection signatures applicable to the one or more workloads; and providing the identified set of intrusion detection signatures to an intrusion detection system operating on the particular host computer for enforcement. ### Claim 13 (depends on 12) The non-transitory machine readable medium of claim 12, wherein the filtering operation further comprises comparing contextual attributes in the plurality of contextual attributes with contextual attributes specified by intrusion detection signatures in the plurality of intrusion detection signatures. ### Claim 14 (depends on 12) The non-transitory machine readable medium of claim 12, wherein the plurality of intrusion detection signatures comprises (i) a first set of intrusion detection signatures collected from the at least one host computer and (ii) a second set of intrusion detection signatures collected from third-party sources in the datacenter, the third-party sources comprising sources external to the at least one host computer in the datacenter. ### Claim 15 (depends on 12) The non-transitory machine readable medium of claim 12, wherein: after receiving the plurality of contextual attributes, the program further comprises a set of instructions for providing the plurality of contextual attributes and the plurality of intrusion detection signatures to a user for enabling the user to select (i) specific workloads identified based on the plurality of contextual attributes, and (ii) sets of intrusion detection rules to apply to the specific workloads. ### Claim 16 (depends on 15) He non-transitory machine readable medium of claim 15, wherein only a first subset of the identified set of intrusion detection signatures comprises intrusion detection signatures identified by the filtering operation, wherein a second subset of the identified set of intrusion detection signatures comprises intrusion detection signatures selected by the user for workloads performed by the plurality of machines. ### Claim 17 (depends on 12) The non-transitory machine readable medium of claim 12, wherein the identified set of intrusion detection signatures comprises intrusion detection signatures for detecting (i) anomalous user behavior and (ii) anomalous data message traffic behavior. ### Claim 18 (depends on 12) The non-transitory machine readable medium of claim 12, wherein the set of instructions for using the received plurality of contextual attributes to perform the filtering operation to identify the set of intrusion detection signatures comprises a set of instructions for filtering out intrusion detection signatures in the plurality of intrusion detection signatures that are not applicable to the one or more workloads, wherein the identified set of intrusion detection signatures comprises intrusion detection signatures that remain after the filtering operation is complete. ### Claim 19 (depends on 1) The method of claim 1, wherein the plurality of contextual attributes comprises at least one of a traffic type, process name, file hash, publisher information, installation path, user identity, and source and destination addresses. ### Claim 20 (depends on 1) The method of claim 1, wherein the plurality of contextual attributes is configured to convert the user intent into a set of one or more intrusion detection scripts for enforcement.