Learned control flow monitoring and enforcement of unobserved transitions
AssigneeCisco Technology, Inc.
InventorsAndrew Zawadowskiy, Vincent E. Parla, Oleg Bessonov
Life of this patent
Estimating the term…
Abstract
Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining a learned control flow diagram for a process on a computing system and monitoring execution of the process on the computing system using the control flow diagram. An unobserved transition is determined based on the learned control flow diagram and the unobserved transition is classified as safe or unsafe based on a monitoring component analysis. An action is performed based on the safety classification and the learned control flow diagram.
Claims18
A method for monitoring a computing system, comprising:
- determining a learned control flow diagram for a process executed on a computing system by observing executions of transitions during an observation period during which safe executions of transitions are permitted to execute and be observed;
- monitoring execution of the process on the computing system using the learned control flow diagram;
- determining an unobserved transition of the process based at least in part on the unobserved transition not being represented in the learned control flow diagram;
- determining a classification of the unobserved transition as being safe by analyzing, using a monitoring component, the unobserved transition;
- and
- performing an action based at least in part on the classification and the learned control flow diagram, the action including adding the unobserved transition to the learned control flow diagram.
A system comprising:
- one or more processors;
- and
- one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
- determining a learned control flow diagram for a process executed on a computing system by observing executions of transitions during an observation period during which safe executions of transitions are permitted to execute and be observed;
- monitoring execution of the process on the computing system using learned control flow diagram;
- determining an unobserved transition of the process based at least in part on the unobserved transition not being represented in the learned control flow diagram;
- determining a classification of the unobserved transition as being safe by analyzing, using a monitoring component, the unobserved transition;
- and
- performing an action based at least in part on the classification and the learned control flow diagram, the action including adding the unobserved transition to the learned control flow diagram.
One or more non-transitory computer-readable media storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to:
- determine a learned control flow diagram for a process executed on a computing system by observing executions of transitions during an observation period during which safe executions of transitions are permitted to execute and be observed;
- monitor execution of the process on the computing system using the learned control flow diagram;
- determine an unobserved transition of the process based at least in part on the unobserved transition not being represented in the learned control flow diagram;
- determine a classification of the unobserved transition as being safe by analyzing, using a monitoring component, the unobserved transition;
- and
- performing an action based at least in part on the classification and the learned control flow diagram, the action adding the unobserved transition to the learned control flow diagram.
Dependencies are inferred from the claim text.