Process tree and tags
AssigneeCapsule8, Inc.
InventorBrandon M. Edwards
Life of this patent
Estimating the term…
Abstract
Information associated with a process is received. At least a portion of the received information is used to modify a Process Tree. Modifying the Process Tree includes at least one of: (1) adding a Tag to the Process Tree and (2) modifying a Tag in the Process Tree. An Alert is generated based at least in part in response to determining that a Strategy has been matched.
Claims20
A computer program product comprising computer executable code embodied in in a non-transitory computer readable storage medium that, when executing on one or more processors, causes the one or more processors to perform steps comprising:
- storing a process tree that includes a plurality of processes executing on a computing system;
- storing one or more tags for the plurality of processes in the process tree, wherein:
- each tag contains state information about an associated one of the plurality of processes, and
- each tag propagates within the process tree according to an inheritance property that identifies the tag as at least one of inheritable, not inheritable, or inherited;
- applying a detection strategy based on data in the process tree to detect events on the computing system indicative of a malicious behavior;
- in response to a detection of the malicious behavior on the computing system with the detection strategy, generating an alert for one of the plurality of processes in the process tree;
- and
- propagating the alert as an additional tag in the process tree based on a corresponding inheritance property for the alert.
A method comprising:
- storing a process tree that includes a plurality of processes executing on a computing system;
- storing one or more tags for the plurality of processes in the process tree, wherein:
- each tag contains state information about an associated one of the plurality of processes, and
- each tag propagates within the process tree according to an inheritance property that identifies the tag as at least one of inheritable, not inheritable, or inherited;
- applying a detection strategy to detect events on the computing system indicative of a malicious behavior;
- in response to a detection of the malicious behavior on the computing system with the detection strategy, generating an alert for one of the plurality of processes;
- and
- propagating the alert as an additional tag in the process tree based on a corresponding inheritance property for the alert.
A system, the system comprising a processor configured by computer executable code stored in a memory to perform steps comprising:
- storing a process tree that includes a plurality of processes executing on a computing system;
- storing one or more tags for the plurality of processes in the process tree, wherein:
- each tag contains state information about an associated one of the plurality of processes, and
- each tag propagates within the process tree according to an inheritance property that identifies the tag as at least one of inheritable, not inheritable, or inherited;
- applying a detection strategy to detect events on the computing system indicative of a malicious behavior;
- in response to a detection of the malicious behavior on the computing system with the detection strategy, generating an alert for one of the plurality of processes;
- and
- propagating the alert as an additional tag in the process tree based on a corresponding inheritance property for the alert.
Dependencies are inferred from the claim text.