Systems and Methods for Detecting and Responding to Security Threats Using Application Execution and Connection Lineage Tracing

Abstract

Systems and methods for detecting and responding to security threats using application execution and connection lineage tracing in accordance with embodiments of the invention are disclosed. In one embodiment, a process for detecting suspicious activity in a network and in a computer server system includes receiving at a collector server a first piece of activity data including a first set of attributes, each attribute having a particular value, combining a first set of context information with the first piece of activity data to generate a first activity record, comparing the first activity record to a set of baseline signatures, where each baseline signature includes a second set of attributes, each attribute having a particular value and each baseline signature being unique in the combination of values of its attributes, incrementing a count of a first matching baseline signature from the set of baseline signatures when the first activity record has the same values for all attributes in the first matching baseline signature, receiving from a second connection and application execution sensor a second piece of activity data including a third set of attributes, each attribute having a particular value, combining, a second set of context information with the second piece of activity data to generate a second activity record, and generating an alert when the values of the attributes of the second activity record differ from all baseline signatures in the set of baseline signatures by at least a predetermined threshold number of attributes.

Dependencies are inferred from the claim text.