Back to results
US 12,602,515 B2Granted
Instrumentation using access time value
AssigneeRapidFort, Inc.
InventorsMehran Farimani, Rajeev Thakur, Chien-Hung Chen
Life of this patent
Estimating the term…
Abstract
A computer sets an access time for a set of files to an initial value. Upon accessing a file by a set of executables, the computer sets the access time of the file to a new value. The computer identifies, from the set of files, a subset of files accessed by the set of executables based on the access time of files in the subset being different from the initial value. The computer provides an output representing the subset of files.
Claims30
A computer-implemented method for identifying accessed files in a computing environment by instrumenting one or more applications, the method comprising:
- setting, by an initialization operation of an instrumentation engine at a beginning of an instrumentation session for an instrumented application comprising a set of executables, an access time for a set of files to an initial value, wherein the initial value corresponds to a predetermined time prior to a start time of executing the set of executables;
- adding, to an application image comprising the set of executables, a first wrapper engine for execution upon initiation of the application image, wherein the first wrapper engine sets the access time for the set of files to the initial value;
- executing at least a part of the set of executables in the instrumented application, wherein upon accessing a file by the set of executables a kernel of the computing environment sets the access time of the file to a new value;
- identifying, from the set of files by a data collection operation of the instrumentation engine at an end of the instrumentation session, a subset of files accessed by the set of executables based on the access time of the files in the subset being different from the initial value;
- and
- providing an output representing the subset of files, wherein the output enables at least one of detecting unusual behavior of the one or more applications or restricting access to one or more files not included in the subset of files.
3 more elements
A non-transitory machine-readable medium storing instructions which, when executed by one or more computing machines, cause the one or more computing machines to perform operations comprising:
- setting, by an initialization operation of an instrumentation engine at a beginning of an instrumentation session for an instrumented application comprising a set of executables, an access time for a set of files to an initial value, wherein the initial value corresponds to a predetermined time prior to a start time of executing the set of executables;
- executing at least a part of the set of executables in the instrumented application, wherein upon accessing a file by the set of executables a kernel of a computing environment sets the access time of the file to a new value;
- identifying, from the set of files by a data collection operation of the instrumentation engine at an end of the instrumentation session, a subset of files accessed by the set of executables based on the access time of the files in the subset being different from the initial value;
- and
- providing an output representing the subset of files, wherein the output enables at least one of detecting unusual behavior of one or more applications or restricting access to one or more files not included in the subset of files, wherein the set of executables comprises a stub of at least one executable from an application image, wherein the stub sets the access time for the set of files to the initial value, and wherein the stub identifies the subset of files, wherein the stub is generated during instrumentation of the at least one executable.
2 more elements
A system comprising:
- processing circuitry;
- and
- a memory storing instructions which, when executed by the processing circuitry, cause the processing circuitry to perform operations comprising:
- setting, by an initialization operation of an instrumentation engine at a beginning of an instrumentation session for an instrumented application comprising a set of executables, an access time for a set of files to an initial value, wherein the initial value corresponds to a predetermined time prior to a start time of executing the set of executables;
- executing at least a part of the set of executables in the instrumented application, wherein upon accessing a file by the set of executables a kernel of a computing environment sets the access time of the file to a new value;
- identifying, from the set of files by a data collection operation of the instrumentation engine at an end of the instrumentation session, a subset of files accessed by the set of executables based on the access time of the files in the subset being different from the initial value;
- and
- providing an output representing the subset of files, wherein the output enables at least one of detecting unusual behavior of one or more applications or restricting access to one or more files not included in the subset of files, wherein the set of executables comprises a stub of at least one executable from an application image, wherein the stub sets the access time for the set of files to the initial value, and wherein the stub identifies the subset of files, wherein the stub is generated during instrumentation of the at least one executable.
5 more elements
Dependencies are inferred from the claim text.