Automatic mitigation of corrupted or compromised compute resources

A system, comprising:

• at least one processor;
• and
• at least one memory that stores program code configured to be executed by the at least one processor, the program code comprising:
• a notary configured to obtain an image corresponding to an application, the image including one or more binaries, one or more scripts, one or more configurations, executable program code of the application and/or one or more dependencies necessary for execution of the application, the notary further configured to statically analyze the image file to obtain characteristics of the image file, the characteristics of the image file including at least one of:
• one or more packages included in the image file, one or more files included in the image file, or one or more commands that are to be executed during runtime of the application;
• a validator configured to:
• receive runtime characteristics of an executable instance of the application executing on a compute instance, the application having been instantiated by mapping the image into a memory space of a compute instance allocated for the application to create an executable instance of the application, wherein the runtime characteristics include at least one of:
• one or more packages loaded into a memory space allocated for the application, one or more files loaded into the memory space allocated for the application, or one or more commands executed by the application, wherein the runtime characteristics further comprise a bitmap representing pages that are loaded into the memory space allocated for application and that store executable segments of the application, and a first hash representative of executable segments of the application;
• and
• compare the characteristics of the image file to the runtime characteristics of the executable instance of the application to determine discrepancies between at least one of:
• the one or more packages-included in the image file and the one or more packages loaded into the memory space allocated for the application, the one or more files included in the image file and the one or more files loaded into the memory space allocated for the application, or the one or more commands that are to be executed during runtime of the application and the one or more commands executed by the application, wherein the comparing comprises:
• retrieving data from portions of a code segment of the image file, the portions being determined based on the bitmap and corresponding to the pages;
• generating a second hash representative of the data retrieved from the portions of the code segment;
• and
• determining whether the first hash is equal to the second hash;
• and
• a mitigator configured to, responsive to determining that the first hash is not equal to the second hash, determine that the executable instance of the application has been compromised with malicious code and perform one or more actions to mitigate the malicious code.

A non-transitory computer-readable storage medium having program instructions recorded thereon that, when executed by at least one processor, perform a method for determining whether an application has been compromised by malicious code, the method comprising:

• obtaining an image corresponding to the application, the image including one or more binaries, one or more scripts, one or more configurations, executable program code of the application and/or one or more dependencies necessary for execution of the application;
• statically analyzing the image file to obtain characteristics of the image file, the characteristics of the image file including at least one of:
• one or more packages included in the image file, one or more files included in the image file, or one or more commands that are to be executed during runtime of the application;
• mapping the image into a memory space of a compute instance allocated for the application to create an executable instance of the application;
• receiving runtime characteristics of the executable instance of the application executing on the compute instance, the runtime characteristics including at least one of:
• one or more packages loaded into a memory space allocated for the application, one or more files loaded into the memory space allocated for the application, or one or more commands executed by the application, wherein the runtime characteristics further comprise a bitmap representing pages that are loaded into the memory space allocated for application and that store executable segments of the application, and a first hash representative of executable segments of the application;
• comparing the characteristics of the image file to the runtime characteristics of the executable instance of the application to determine discrepancies between at least one of:
• the one or more packages-included in the image file and the one or more packages loaded into the memory space allocated for the application, the one or more files included in the image file and the one or more files loaded into the memory space allocated for the application, or the one or more commands that are to be executed during runtime of the application and the one or more commands executed by the application, wherein the comparing comprises:
• retrieving data from portions of a code segment of the image file, the portions being determined based on the bitmap and corresponding to the pages;
• generating a second hash representative of the data retrieved from the portions of the code segment;
• and
• determining whether the first hash is equal to the second hash;
• and
• responsive to determining the discrepancies:
• determining, in response to determining that the first hash is not equal to the second hash, that the executable instance of the application has been compromised with malicious code;
• and
• performing one or more actions to mitigate the malicious code.