Cloud-Based Tamper Detection
AssigneeMcAfee, Inc.
InventorLior Rudnik
Life of this patent
Estimating the term…
Abstract
There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; a user application; telemetry probes to collect telemetry about use of the user space application; a detection proxy to collect telemetry data from the telemetry probes and forward the telemetry data to a detection cloud service; and logic to receive from the detection cloud service a detection message that the user application has exhibited behavior consistent with tampering, and to take remedial action responsive to the detection message.
Claims20
A computing apparatus, comprising:
- a hardware platform comprising a processor and a memory;
- a user application;
- telemetry probes to collect telemetry about use of the user application;
- a detection proxy to collect telemetry data from the telemetry probes and forward the telemetry data to a detection cloud service;
- and
- logic to receive from the detection cloud service a detection message that the user application has exhibited behavior consistent with tampering, and to take remedial action responsive to the detection message.
One or more tangible, non-transitory computer-readable storage media having stored thereon executable instructions to instruct a processor to:
- install telemetry probes for a local application's access to a remote application programming interface (API);
- install an application backend for the local application, the application backend comprising a detection engine, the detection engine comprising instructions to record and forward telemetry about the remote API calls to a detection cloud service;
- receive from the detection cloud service a tampering notification;
- and
- act on the tampering notification.
A server apparatus, comprising:
- a hardware platform comprising a processor and a memory;
- a network interface;
- and
- instructions encoded within the memory to instruct the processor to:
- receive from a detection proxy of an endpoint telemetry data related to a user application of the endpoint's use of one or more remote application programming interfaces (APIs);
- analyze the telemetry data;
- determine from the analysis that the user application exhibits behavior out of bounds of expected behavior for the user application;
- and
- send a notification of the out-of-bounds behavior.
Dependencies are inferred from the claim text.