Security threat detection based on process information
AssigneeVMware, Inc.
InventorsBaibhav SINGH, Jayant JAIN
Life of this patent
Estimating the term…
Abstract
Example methods and systems for a computer system to perform security threat detection are described. In one example, a computer system may intercept an egress packet from a virtualized computing instance to pause forwarding of the egress packet towards a destination and obtain process information associated a process from which the egress packet originates. The computer system may initiate security analysis based on the process information. In response to determination that the process is a potential security threat based on the security analysis, the egress packet may be dropped, and a remediation action performed. Otherwise, the egress packet may be forwarded towards the destination.
Claims21
A method for a computer system to perform security threat detection, wherein the method comprises:
- intercepting an egress packet from a virtualized computing instance supported by the computer system to pause forwarding of the egress packet towards a destination;
- obtaining, from the virtualized computing instance, process information associated a process from which the egress packet originates;
- based on the process information, initiating a security analysis of the process;
- and
- in response to determination that the process is a potential security threat based on the security analysis, dropping the egress packet and performing a remediation action;
- but otherwise, allowing forwarding of the egress packet towards the destination.
A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a computer system, cause the processor to perform security threat detection, wherein the method comprises:
- intercepting an egress packet from a virtualized computing instance supported by the computer system to pause forwarding of the egress packet towards a destination;
- obtaining, from the virtualized computing instance, process information associated a process from which the egress packet originates;
- based on the process information, initiating a security analysis of the process;
- and
- in response to determination that the process is a potential security threat based on the security analysis, dropping the egress packet and performing a remediation action;
- but otherwise, allowing forwarding of the egress packet towards the destination.
A computer system, comprising:
- a processor;
- and
- a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform the following:
- intercept an egress packet from a virtualized computing instance supported by the computer system to pause forwarding of the egress packet towards a destination;
- obtain, from the virtualized computing instance, process information associated a process from which the egress packet originates;
- based on the process information, initiate a security analysis of the process;
- and
- in response to determination that the process is a potential security threat based on the security analysis, drop the egress packet and perform a remediation action;
- but otherwise, allow forwarding of the egress packet towards the destination.
Dependencies are inferred from the claim text.