# US 2018/0322286 A1 · Parametric behavioral pattern definition

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0322286 A1
- Document ID: US20180322286A1
- Status: Published application
- Kind: A1
- Application number: 15/585,156
- Filed: 2017-05-02
- Published: 2018-11-08
- Earliest claimed: 2017-05-02
- Assignees: CrowdStrike, Inc.
- Applicants: CrowdStrike, Inc.
- Inventors: David F. Diehl; Daniel W. Brown; Aaron Javon Marks; Kirby Koster; Daniel T. Martin
- Web page: https://patentgrep.com/patent/US20180322286A1

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/552: {involving long-term monitoring or reporting}
- H04L 63/14: {for detecting or protecting against malicious traffic}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06N 20/00: Machine learning
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A security agent implemented on a monitored computing device is described herein. The security agent has access to parametric behavioral pattern definitions that, in combination with canonical patterns of behavior, configure the security agent to match observed behavior with known computing behavior that is benign or malignant. This arrangement of the definitions and the pattern of behavior allow the security agent's behavior to be updated by a remote security service without updating a configuration of the security agent. The remote security service can create, modify, and disseminate these definitions and patterns of behavior, giving the security agent real-time ability to respond to new behaviors exhibited by the monitored computing device.

## Claims

### Claim 1

A non-transitory computer-readable media having a security agent stored thereon:
the security agent configured to be executed by a processor on a monitored computing device,
the security agent including a pattern of behavior (PoB) that has an empty field, and
the security agent having access to memory storing a definition that includes a parameter value corresponding to the empty field and a behavior identifier,
the security agent further including:
an accumulator executable by the processor to accumulate behavior information characterizing behavior exhibited by the monitored computing device into a test pattern, wherein the test pattern includes an observed pattern of behavior and an observed parameter value; and
a matcher executable by the processor to:
determine whether the test pattern matches a union of the PoB and the parameter value specified by the definition, and
based on a determination that the test pattern matches the union, emit the behavior identifier.

### Claim 2 (depends on 1)

The non-transitory computer readable media of claim 1 further including:
an event collector that observes behaviors of the monitored computing device and generates event notifications based on the behaviors; and
a policy that determines a subset of the event notifications to forward to the accumulator, wherein the event notifications include the behavior information.

### Claim 3 (depends on 1)

The non-transitory computer readable media of claim 1, wherein:
the matcher includes a regular expression that includes search terms determined by a union of the PoB and the parameter value of the definition;
the PoB is part of a configuration file of the security agent; and
the definition and the test pattern are stored in memory accessible to the security agent.

### Claim 4 (depends on 3)

The non-transitory computer readable media of claim 3, wherein:
the empty field is a first empty field of a plurality of empty fields;
the parameter value is a first parameter value of a plurality of parameter values specified by the definition, each individual parameter value of the plurality of parameter values corresponding to an individual one of the plurality of empty fields;
the definition being a first definition of a plurality of definitions, each definition of the plurality of definitions specifying a pluralities of different parameter values; and
the matcher executable by the processor to determine whether the test pattern matches any union of the PoB and parameter values specified by one of the plurality of definitions.

### Claim 5 (depends on 4)

The non-transitory computer readable media of claim 4, wherein the matcher determines whether the test pattern matches any union of the PoB and parameter values specified by one of the plurality of definitions in a single computational pass.

### Claim 6 (depends on 1)

The non-transitory computer readable media of claim 1, wherein:
the behavior identifier identifies the union of the PoB and the parameter value as being associated with one or more of benign activity, malicious activity, benign software, or malicious malware, and
the definition further includes a disposition that specifies an action to take responsive to matching the test pattern with the union of the PoB and the parameter value.

### Claim 7 (depends on 6)

The non-transitory computer readable media of claim 6, wherein the action specified by the disposition includes one or more of:
no operation;
communicating a notification via a communications interface to a remote security service;
communicating the notification via the communications interface to the remote security service and to a user interface associated with the security agent;
stopping execution of an object associated with the test pattern of behavior;
preventing an action related to the test pattern;
quarantining a file associated with the test pattern;
tagging the definition as being a false positive; or
shutting down one or more current or attempted network connections of the monitored computing device according to a quarantine policy.

### Claim 8 (depends on 1)

The monitored computing device of claim 1, wherein the definition is one of a set of definitions accessible to the matcher and the monitored computing device further including:
a communications interface configured to receive a file including the plurality of definitions, the file being compiled at a remote security service and including a second definition specifying a second parameter value, a second behavior identifier, and a second disposition.

### Claim 9 (depends on 8)

The non-transitory computer readable media of claim 8, wherein the second definition configures the security agent to:
recognize a second union of the pattern of behavior and the second parameter value by matching second behavior exhibited by the monitored computing device with the second union, and
initiate an action specified by the second disposition based on observation of that behavior.

### Claim 10 (depends on 9)

The non-transitory computer readable media of claim 9, wherein:
the set of definitions is a first set of definitions;
the PoB is a first PoB associated with the first set of definitions;
the empty field is a first empty field of a plurality of fields; and
the security agent further includes a second PoB associated with a second set of definitions, the second PoB specifying a different pattern of behavior and a different empty field that corresponds to values specified by the second set of definitions.

### Claim 11 (depends on 1)

The non-transitory computer readable media of claim 1, wherein:
the behavior identifier is a first behavior identifier;
the definition is one of a first group of definitions corresponding to the PoB, each of which is associated with the first behavior identifier; and
the security agent having access to memory storing a second group of definitions corresponding to the PoB, the second group of definitions being associated with a second behavior identifier and being disj oint from the first group.

### Claim 12

A system comprising:
a processor;
a communications interface;
a memory having stored thereon a security agent including a matcher that recognizes a pattern of behavior (PoB), the PoB including an empty field;
the memory further having a first definition stored in a first definition file thereon, the first definition including a first value corresponding to the empty field; and
wherein the security agent, when executed by the processor, configures the system to perform operations including:
obtaining, via the communications interface, a second definition file including the first definition and a second definition that includes a second value corresponding to the empty field;
obtaining behavior information regarding behavior exhibited by a computing device and corresponding to the pattern of behavior;
accumulating the behavior information into a test pattern based at least in part on detecting that the behavior information corresponds with at least part of the pattern of behavior; and
determining whether the test pattern matches a first union of the PoB with the empty field populated by the first value or a second union of the PoB with the empty field populated by the second value.

### Claim 13 (depends on 12)

The system of claim 12, wherein:
the first definition further includes a first behavior identifier and a first disposition, the first behavior identifier indicating that the first union is malicious or benign;
the second definition further includes a second behavior identifier and a second disposition, the second behavior identifier indicating that the second union is malicious or benign; and
the operations further comprise:
determining that the test pattern matches the first union, and
based on determining that the test pattern matches the first union, emitting one or more of the first behavior identifier or the first disposition; or
determining that the test pattern matches the second union, and
based on determining that the test pattern matches the second union, emitting one or more of the second behavior identifier or the second disposition; or
determining that the test pattern does not match either the first union or the second action, and
based on determining that the test pattern does not match either the first union or the second union, transmitting at least part of the test pattern via the communications interface to a remote security service or taking no further action.

### Claim 14 (depends on 12)

The system of claim 12, wherein determining whether the test pattern matches the first union or the second union is conducted in a single computational pass.

### Claim 15 (depends on 12)

The system of claim 12, wherein:
the empty field is a first empty field;
the PoB is a first PoB that is one of a plurality of PoBs that include a second PoB;
the first definition and the second definition are associated with the first PoB; and
the second PoB specifies a second empty field.

### Claim 16 (depends on 15)

The system of claim 15, the operations further including:
obtaining, via the communications interface, a third definition and a third value corresponding to the second empty field of the second PoB;
obtaining second behavior information regarding behavior exhibited by the computing device and corresponding to the second PoB;
accumulating the second behavior information into a second test pattern based at least in part on the second behavior information corresponding with at least part of the second PoB; and
determining whether the second test pattern matches a union of the second PoB and the third value.

### Claim 17

A method comprising:
obtaining, via a communications interface, a test pattern from a security agent operating on a monitored computing device, the test pattern including:
a value that characterizes a portion of behavior exhibited by the monitored computing device and observed by the security agent;
making available for selection, via a display device, a plurality of behavior identifiers and a plurality of dispositions for selection;
obtaining selections corresponding to a behavior identifier and a disposition from among the plurality of behavior identifiers and the plurality of dispositions, an individual behavior identifier of the plurality of behavior identifiers being associated with one or more dispositions;
based at least in part on obtaining the selections, creating a definition that includes the behavior identifier, the disposition, and the value; and
transmitting, via the communications interface, the definition to the security agent.

### Claim 18 (depends on 17)

The method of claim 17, wherein:
the value includes a characteristic of behavior exhibited by the monitored computing device or a system state;
the behavior identifier includes a tag that characterizes the test pattern as being behavior of benign software or malware;
the disposition identifies an action to take if the security agent detects a union of the pattern of behavior and the value; and
the method further comprises altering a response of the security agent to detecting that behavior exhibited by the monitored computing device corresponds to the definition by transmitting an update to the definition that includes one or more of a different behavior identifier or a different disposition to replace the behavior identifier or the different disposition.

### Claim 19 (depends on 17)

The method of claim 17, further comprising:
obtaining, via a communications interface, a series of behaviors observed by the security agent that does not match any pattern of behavior (PoB) stored at the security agent;
obtaining an indication to create a PoB;
creating the new PoB by parameterizing at least a portion of the series of behaviors by removing a value from the series of behaviors and defining the portion as an empty field;
obtaining a selection of one of the plurality of behavior identifiers and a selection of one of the plurality of dispositions;
at least partially in response to the selection, creating a new definition that specifies the value removed from the event information, a new instance identifier that is associated with the PoB, the selected one of the plurality of behavior identifiers, and the selected one of the plurality of dispositions;
transmitting, via the communications interface, instructions to modify a configuration of the security agent to include the new PoB; and
transmitting, via the communications interface, the new definition to the security agent.

### Claim 20

A method comprising:
obtaining event information based on behavior exhibited by a computing device;
accumulating the event information to create a test pattern;
determining whether the test pattern matches any one of a plurality of definitions by determining whether the test pattern matches a pattern of behavior (PoB) having one or more empty fields populated by corresponding one or more parameter values of a respective one of the plurality of definitions; and
initiating an action based on a determination that the test pattern matches the PoB with the empty field of the PoB populated by a parameter value of a matched definition and based on a disposition or behavior identifier associated with the matched definition.

### Claim 21 (depends on 20)

The method of claim 20, wherein:
the PoB is part of a configuration file of a security agent stored on the computing device;
a definition stored in memory accessible to the security agent includes the parameter value and the disposition; and
populating the empty field of the pattern of behavior with the parameter value completes a description of a series of behavior exhibited by the computing device.

### Claim 22 (depends on 20)

The method of claim 20 further including:
receiving an additional definition that includes a second disposition and a second parameter value, a union of the second parameter value and the PoB describing a defined series of computational behavior; and
storing the additional definition in memory accessible to the security agent.

### Claim 23 (depends on 20)

The method of claim 20, wherein determining whether the test pattern matches any one of a plurality of definitions is conducted in a single computational pass.