Testing instrumentation for intrusion remediation actions
AssigneeMicrosoft Technology Licensing, LLC
InventorsKevin LO, Daiqian HU, Hongquan YIN, Lei HE
Life of this patent
Estimating the term…
Abstract
A set of high level test logic is configured to include a set of insertion points. The high-level test logic can be controlled to insert test conditions into a data center configuration. It can also be configured to execute remediation actions that are to be taken, and validation actions to be performed in order to determine whether the remediation action works against the test conditions. Different instances of the high-level test logic can be configured for different environments and different test conditions.
Claims20
A computing system, comprising:
- an instrumentation configuration system that receives a user configuration input and configures validation instrumentation, to obtain configured validation instrumentation, to validate a remedial action performed in the computing system in response to a detected malicious activity performed in the computing system;
- an environment handling system that selects a set of machines in the computing system and configures the set of selected machines in an isolated environment, functionally isolated from other machines in the computing system;
- a remediation test scheduling system that receives a user scheduling input identifying scheduling criteria, under which the configured validation instrumentation is to be run on the computing system, and to detect presence of the scheduling criteria;
- and
- an instrumentation execution system that automatically controls the configured validation instrumentation to validate the remedial action on the selected machines in the isolated environment based on the remediation test scheduling system detecting the presence of the scheduling criteria.
A computing system, comprising:
- a malicious activity detection system, that detects malicious activity on the computing system, indicative of an unauthorized user obtaining access to the computing system;
- an intrusion remediation system that executes an intrusion remediation action in response to detection of the malicious activity;
- and
- a remediation validation system that automatically generates an isolated computing environment in the computing system, sets a test condition in the isolated computing environment indicative of the malicious activity, and validates that the intrusion remediation system performs the intrusion remediation action in response to the test condition set in the isolated computing environment.
A method of controlling a computing system, comprising:
- detecting that a malicious intrusion remediation test scheduling criterion is met;
- automatically selecting a set of machines in the computing system based on detection of the test scheduling criterion;
- automatically configuring the selected set of machines to generate an isolated computing environment in the computing system;
- controlling the selected set of machines to set a remediable test condition in the isolated computing environment indicative of a malicious intrusion into the computing system;
- performing a predefined remediation action to remedy the test condition in the isolated computing environment;
- automatically validating the predefined remediation action by determining whether the predefined remediation action remedied the remediable test condition in the isolated computing environment;
- and
- generating a validation output indicative of whether the predefined remediation action remedied the remediable test condition.
Dependencies are inferred from the claim text.