Dynamic detection strategies for kernel sensors
AssigneeCapsule8, Inc.
InventorBrandon M. Edwards
Life of this patent
Estimating the term…
Abstract
Detection strategies for a node are selected and deployed based on the amount of data collection that is associated with various modes of telemetry available to the node.
Claims20
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for deploying strategies to detect malicious activity on an endpoint, the computer instructions configuring one or more processors to perform the steps of:
- executing a sensor to monitor kernel activity on a node;
- with an analytics component for the node, providing a strategy for detecting malicious behavior on the node;
- providing a plurality of modes of telemetry collection for the strategy including two or more of:
- a data collection tap built into a kernel subsystem,
- an on-demand collection hook for exported kernel symbols, and
- an on-demand collection hook for kernel function entry or return;
- enumerating metadata for the sensor, the metadata including configuration information used to initialize the sensor;
- selecting one of the plurality of modes of telemetry collection for the strategy based on a highest performing one of the plurality of modes of telemetry collection corresponding to the metadata for the sensor;
- and
- applying the strategy to the one of the plurality of modes of telemetry collection to monitor for malicious behavior on the node.
A method for deploying strategies to detect malicious activity on an endpoint, the method comprising:
- executing a sensor to monitor kernel activity on a node;
- with an analytics component for the node, providing a strategy for detecting malicious behavior on the node with data from the sensor;
- providing a plurality of modes of telemetry collection for the strategy, including at least one on-demand collection hook for kernel function entry or return;
- enumerating metadata for the sensor, the metadata including configuration information used to initialize the sensor;
- selecting one of the plurality of modes of telemetry collection for the strategy based on a highest performing one of the plurality of modes of telemetry collection corresponding to the metadata for the sensor;
- and
- prioritizing the strategy relative to one or more other strategies for monitoring the node based on a rate of data collection associated with the one of the plurality of modes of telemetry collection.
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for deploying strategies to detect malicious activity on an endpoint, the computer instructions configuring one or more processors to perform the steps of:
- executing a sensor to monitor kernel activity on a node;
- with an analytics component for the node, providing a strategy for detecting malicious behavior on the node;
- providing a plurality of modes of telemetry collection for the strategy including two or more of:
- a data collection tap built into a kernel subsystem,
- an on-demand collection for exported kernel symbols, and
- an on-demand collection for kernel function entry or return;
- enumerating metadata for the sensor, the metadata including configuration information used to initialize the sensor;
- selecting one of the plurality of modes of telemetry collection for the strategy based on a highest performing one of the plurality of modes of telemetry collection corresponding to the metadata for the sensor;
- and
- applying the strategy to the one of the plurality of modes of telemetry collection to monitor for malicious behavior on the node.
Dependencies are inferred from the claim text.