Program Execution Anomaly Detection for CyberSecurity

A method comprising:

• receiving, by one or more computer systems, an acceptable behavior model that is indicative of normal operation of flow control, flow status, or data flow of actions performed by a program with only expected behavior as determined by execution of the program in a first mode of operation in a controlled environment in accordance with the normal operation with only expected behavior;
• executing, by the one or more computer systems, the program in a second mode of operation after the program has been deployed in runtime in a non-isolated, real-world, operational network environment;
• detecting, by the one or more computer systems during the second mode of operation, a delayed event that can be activated upon a condition having been met, wherein the delayed event is detected by a comparison of the acceptable behavior model with an operational sequence of events that includes the delayed event as a current action during the second mode of operation, and the delayed event is not included in the acceptable behavior model;
• and
• not performing the delayed event and generating an alert to stop the executing of the program.

A method comprising:

• receiving, by one or more computer systems, an acceptable behavior model that is indicative of normal operation of flow control, flow status, or data flow of actions performed by a program with only expected behavior as determined by execution of the program in a first mode of operation in a controlled environment in accordance with the normal operation with only expected behavior;
• executing, by the one or more computer systems, the program in a second mode of operation after the program has been deployed in runtime in a non-isolated, real-world, operational network environment;
• detecting, by the one or more computer systems during the second mode of operation, an event that attempts to execute remote code, wherein the event is detected by a comparison of the acceptable behavior model with an operational sequence of events that includes the event as a current action during the second mode of operation, and the event is not included in the acceptable behavior model;
• and
• not performing the event and generating an alert to stop the executing of the program.

A method comprising:

• executing, by one or more computer systems, a program in a first mode of operation in a controlled environment in accordance with an expected operation with only expected behavior;
• generating, by the one or more computer systems, a training record of events comprising a plurality of training sequences of events that occur during the expected operation of the program;
• generating, by the one or more computer systems using the training record of events, an acceptable behavior model that is indicative of expected behavior of flow control, flow status, or data flow of actions performed by the program that occur during the expected operation with only the expected behavior;
• executing, by the one or more computer systems, the program in a second mode of operation after the program has been deployed in runtime in a non-isolated, real-world, operational network environment;
• determining, by the one or more computer systems, an operational record of events comprising a plurality of operational sequences of events that occur during the executing of the program in the second mode of operation, each operational sequence of events being obtained at one of a plurality of levels of instrumentation detail, a first level of instrumentation detail being different from a second level of instrumentation detail of the plurality of levels of instrumentation detail, and a first operational sequence of events of the plurality of operational sequences of events including a first current action;
• comparing, by the one or more computer systems, the first operational sequence of events with the acceptable behavior model;
• when the comparing step results in a match between the first operational sequence of events and the acceptable behavior model, performing the first current action in the second mode of operation;
• and
• when the comparing step does not result in the match between the first operational sequence of events and the acceptable behavior model, not performing the first current action and generating an alert to stop the executing of the program.

A method comprising:

• receiving, by one or more computer systems, an acceptable behavior model that is indicative of normal operation of flow control, flow status, or data flow of actions performed by a program with only expected behavior as determined by execution of the program in a first mode of operation in a controlled environment in accordance with the normal operation with only expected behavior;
• executing, by the one or more computer systems, the program in a second mode of operation after the program has been deployed in runtime in a non-isolated, real-world, operational network environment;
• determining, by the one or more computer systems, an operational sequence of events of the program during execution of the program in the second mode of operation, the operational sequence of events including a current action, and the operational sequence of events being generated from a stacktrace;
• comparing, by the one or more computer systems, the operational sequence of events with the acceptable behavior model;
• when the comparing step results in a match between the operational sequence of events and the acceptable behavior model, performing the current action in the second mode of operation;
• and
• when the comparing step does not result in the match between the operational sequence of events and the acceptable behavior model, not performing the current action and generating an alert to stop the executing of the program.

A method comprising:

• receiving, by one or more computer systems, an acceptable behavior model that is indicative of normal operation of flow control, flow status, or data flow of actions performed by a program with only expected behavior as determined by execution of the program in a first mode of operation in a controlled environment in accordance with the normal operation with only expected behavior;
• executing, by the one or more computer systems, the program in a second mode of operation after the program has been deployed in runtime in a non-isolated, real-world, operational network environment;
• determining, by the one or more computer systems, an operational sequence of events of the program during execution of the program in the second mode of operation, the operational sequence of events including a current action, the current action including a SYSCALL, the SYSCALL being intercepted by a processor of the one or more computer systems, and the processor transitioning to an interposer to generate the operational sequence of events upon intercepting the SYSCALL;
• comparing, by the processor running the interposer, the operational sequence of events with the acceptable behavior model;
• when the comparing step results in a match between the operational sequence of events and the acceptable behavior model, performing the current action in the second mode of operation;
• and
• when the comparing step does not result in the match between the operational sequence of events and the acceptable behavior model, not performing the current action and generating an alert to stop the executing of the program.