# US 12,223,337 B2 · Cloud native virtual machine runtime protection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,337 B2 - Document ID: US12223337B2 - Status: Granted - Kind: B2 - Application number: 18/464,799 - Filed: 2023-09-11 - Published: 2023-12-28 - Granted: 2025-02-11 - Earliest claimed: 2018-07-19 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Liron Levin; John Morello; Dima Stopel; Michael Velbaum; Itay Abramowsky; Isaac Schnitzer - Web page: https://patentgrep.com/patent/US12223337B2 ## CPC - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 9/44505: {Configuring for program initiating, e.g. using registry, configuration files} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 16/2379: {Updates performed during online database operations; commit processing} - G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/54: by adding security routines or objects to programs - G06F 21/552: {involving long-term monitoring or reporting} - G06N 20/00: Machine learning - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 2009/45583: {Memory management, e.g. access or allocation} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45591: {Monitoring or debugging support} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for cloud native virtual machine (VM) runtime protection. The method includes creating a normal behavior model for a cloud native VM by training a machine learning model using a training data set including training activities performed by the cloud native VM, the cloud native VM being configured to provide at least one service, wherein the normal behavior model defines at least one capability of each service based on a set of capabilities for respective known services stored within a library of service-to-capability mappings, wherein each capability of a service indicates a plurality of discrete behaviors required by the service; and monitoring an execution of the cloud native VM to detect a deviation from the normal behavior model, wherein the deviation is caused by at least one abnormal behavior of one of the services that is not among the discrete behaviors defined in capabilities for the service. ## Claims ### Claim 1 A method comprising: training a machine learning model to detect normal behavior of one or more services running on a cloud native virtual machine (VM), wherein the machine learning model is trained to detect normal behavior on training data comprising a plurality of discrete behaviors of the one or more services and indications of whether each of the plurality of discrete behaviors corresponds to normal or abnormal behavior; defining capabilities that indicate at least one of allowed behaviors and denied behaviors for each of the one or more services based, at least in part, on behaviors for the one or more services that the trained machine learning model has detected as normal or abnormal; generating a normal behavior model according to the defined capabilities and the trained machine learning model; and detecting a behavior at the cloud native VM that deviates from the normal behavior model, wherein detecting a behavior that deviates from the normal behavior model comprises at least one of, detecting the behavior as an abnormal behavior with the trained machine learning model, detecting the behavior as not corresponding to an allowed behavior for a defined capability, and detecting the behavior as corresponding to a denied behavior for a defined capability. ### Claim 2 (depends on 1) The method of claim 1, wherein defining the capabilities comprises defining the capabilities according to hierarchical relationships, wherein the hierarchical relationships define associations between the cloud native VM, the one or more services running on the cloud native VM, the defined capabilities of the one or more services, and behaviors allowed and denied by the defined capabilities. ### Claim 3 (depends on 1) The method of claim 1, wherein the defined capabilities comprise one or more behavioral rules that define at least one of allowed and denied behaviors for the one or more services. ### Claim 4 (depends on 1) The method of claim 1, wherein the plurality of discrete behaviors includes at least one of running a process, using an input argument for a process, and accessing a file path. ### Claim 5 (depends on 1) The method of claim 1, wherein creating the normal behavior model further comprises, correlating behaviors among the plurality of discrete behaviors for the one or more services with respect to at least one of a parameter used for a process executed as part of the plurality of discrete behaviors, a socket used as part of the plurality of discrete behaviors, and a type of file created as part of the plurality of discrete behaviors; and indicating correlated discrete behaviors in capabilities for corresponding ones of the one or more services. ### Claim 6 (depends on 1) The method of claim 1, further comprising uploading the normal behavior model to a cloud service, wherein the normal behavior model is accessible to installations accessing the cloud service when uploaded to the cloud service. ### Claim 7 (depends on 6) The method of claim 6, further comprising enhancing defined capabilities of the normal behavior model with behavioral rules indicating allowed and denied behaviors at runtime execution of the normal behavior model by the installations accessing the cloud service. ### Claim 8 A non-transitory machine-readable medium having program code stored thereon, the program code comprising instructions to: train a machine learning model to detect normal behavior of one or more services running on a cloud native virtual machine (VM), wherein the machine learning model is trained to detect normal behavior on training data comprising a plurality of discrete behaviors of the one or more services and indications of whether each of the plurality of discrete behaviors corresponds to normal or abnormal behavior; generate a normal behavior model according to defined capabilities for the one or more services and the trained machine learning model, wherein the defined capabilities indicate at least one of allowed behaviors and denied behaviors for each of the one or more services, further wherein defined capabilities are defined based, at least in part, behaviors for the one or more services that the machine learning model has detected as normal or abnormal; and detect a behavior that deviates from the normal behavior model, wherein the program code to detect a behavior that deviates from the normal behavior model comprises instructions to at least one of, detect the behavior as an abnormal behavior with the trained machine learning model, detect the behavior as not corresponding to an allowed behavior for a defined capability, and detect the behavior as corresponding to a denied behavior for a defined capability. ### Claim 9 (depends on 8) The non-transitory machine-readable medium of claim 8, wherein the program code to define the capabilities comprises instructions to define the capabilities according to hierarchical relationships, wherein the hierarchical relationships define associations between the cloud native VM, the one or more services running on the cloud native VM, the defined capabilities of the one or more services, and behaviors allowed and denied by the defined capabilities. ### Claim 10 (depends on 8) The non-transitory machine-readable medium of claim 8, wherein the defined capabilities comprise one or more behavioral rules that define at least one of allowed and denied behaviors for the one or more services. ### Claim 11 (depends on 8) The non-transitory machine-readable medium of claim 8, wherein the plurality of discrete behaviors includes at least one of running a process, using an input argument for a process, and accessing a file path. ### Claim 12 (depends on 8) The non-transitory machine-readable medium of claim 8, wherein the program code to create the normal behavior model further comprises instructions to: correlate behaviors among the plurality of discrete behaviors for the one or more services with respect to at least one of a parameter used for a process executed as part of the plurality of discrete behaviors, a socket used as part of the plurality of discrete behaviors, and a type of file created as part of the plurality of discrete behaviors; and indicate correlated discrete behaviors in capabilities for corresponding ones of the one or more services. ### Claim 13 (depends on 8) The non-transitory machine-readable medium of claim 8, wherein the program code further comprises instructions to upload the normal behavior model to a cloud service, wherein the normal behavior model is accessible to installations accessing the cloud service when uploaded to the cloud service. ### Claim 14 (depends on 13) The non-transitory machine-readable medium of claim 13, wherein the program code further comprises instructions to enhance defined capabilities of the normal behavior model with behavioral rules indicating allowed and denied behaviors at runtime execution of the normal behavior model by the installations accessing the cloud service. ### Claim 15 An apparatus comprising: a processor; and a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to, train a machine learning model to detect normal behavior of one or more services running on a cloud native virtual machine (VM), wherein the machine learning model is trained to detect normal behavior on training data comprising a plurality of discrete behaviors of the one or more services and indications of whether each of the plurality of discrete behaviors corresponds to normal or abnormal behavior; generate a normal behavior model according to defined capabilities for the one or more services and the trained machine learning model, wherein the defined capabilities indicate at least one of allowed behaviors and denied behaviors for each of the one or more services, further wherein defined capabilities are defined based, at least in part, behaviors for the one or more services that the machine learning model has detected as normal or abnormal; and detect a behavior that deviates from the normal behavior model, wherein the instructions to detect a behavior that deviates from the normal behavior model comprise instructions executable by the processor to cause the apparatus to at least one of, detect the behavior as an abnormal behavior by the trained machine learning model, detect the behavior as not corresponding to an allowed behavior for a defined capability, and detect the behavior as corresponding to a denied behavior for a defined capability. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the instructions to define the capabilities comprise instructions executable by the processor to cause the apparatus to define the capabilities according to hierarchical relationships, wherein the hierarchical relationships define associations between the cloud native VM, the one or more services running on the cloud native VM, the defined capabilities of the one or more services, and behaviors allowed and denied by the defined capabilities. ### Claim 17 (depends on 15) The apparatus of claim 15, wherein the defined capabilities comprise one or more behavioral rules that define at least one of allowed and denied behaviors for the one or more services. ### Claim 18 (depends on 15) The apparatus of claim 15, wherein the plurality of discrete behaviors includes at least one of running a process, using an input argument for a process, and accessing a file path. ### Claim 19 (depends on 15) The apparatus of claim 15, wherein the instructions to create the normal behavior model further comprise instructions executable by the processor to cause the apparatus to: correlate behaviors among the plurality of discrete behaviors for the one or more services with respect to at least one of a parameter used for a process executed as part of the plurality of discrete behaviors, a socket used as part of the plurality of discrete behaviors, and a type of file created as part of the plurality of discrete behaviors; and indicate correlated discrete behaviors in capabilities for corresponding ones of the one or more services. ### Claim 20 (depends on 15) The apparatus of claim 15, further comprising instructions executable by the processor to cause the apparatus to upload the normal behavior model to a cloud service, wherein the normal behavior model is accessible to installations accessing the cloud service when uploaded to the cloud service.