Back to results
US 9,882,920 B2Granted
Cross-user correlation for detecting server-side multi-target intrusion
AssigneeEmpire Technology Development LLC
InventorEzekiel Kruglick
Life of this patent
Estimating the term…
Abstract
Technologies are generally described for time-correlating administrative events within virtual machines of a datacenter across many users and/or deployments. In some examples, the correlation of administrative events enables the detection of confluences of repeated unusual events that may indicate a mass hacking attack, thereby allowing attacks kicking network signatures to be detected. Detection of the attack may also allow the repair of affected systems and the prevention of further hacking before the vulnerability has been analyzed or repaired.
Claims20
A method implemented at a datacenter to detect server-side multi-target intrusions, the method comprising:
- receiving first data related to first one or more occurrences of an administrative event associated with first one or more virtual machines associated with first one or more users, wherein the first one or more occurrences of the administrative event are detected by a first hypervisor;
- receiving second data related to second one or more occurrences of the administrative event associated with second one or more virtual machines associated with second one or more users, wherein the second one or more occurrences of the administrative event are detected by a second hypervisor;
- storing the first data and the second data in a database;
- determining, based at least on the first data and the second data, that a number or frequency of occurrences of the administrative event exceeds a probability threshold;
- and
- generating, based on the determination that the number or frequency of the occurrences of the administrative event exceeds the probability threshold, an alert that indicates a possible attack on the datacenter, wherein:
- determining, based on the first data and the second data, that the number or frequency of occurrences of the administrative event exceeds the probability threshold facilitates cross-deployment or cross-user correlation of the administrative event across multiple deployments or users,
- generating the alert facilitates prevention of another attack on the datacenter before one of analysis or repair of a vulnerability of the datacenter, and
- the alert generated based on the determination indicates an alert which represents a higher likelihood of the possible attack on the datacenter when compared to another alert generated in absence of the cross-deployment or cross-correlation of the administrative event.
6 more elements
A cloud-based datacenter, comprising:
- a plurality of virtual machines operable to be executed on one or more physical machines;
- one or more virtual machine monitors configured to:
- provide access to the plurality of virtual machines;
- and
- detect an administrative event associated with one or more users, wherein the administrative event is a low probability event under no-attack conditions;
- and
- a datacenter controller configured to:
- monitor occurrences of the administrative event within the plurality of virtual machines of the datacenter through the one or more virtual machine monitors across multiple users and/or deployments;
- determine that one or more of a number, a frequency, and a distribution of the occurrences of the administrative event exceeds a probability threshold;
- generate, based on the determination that the one or more of the number, the frequency, and the distribution of the occurrences of the administrative event exceeds the probability threshold, an alert that indicates a possible attack on the datacenter;
- and
- share one or more signatures generated for the administrative event with one or more other cloud-based datacenters such that the one or more other cloud-based datacenters are enabled to prevent attacks before detection of a vulnerability of at least one of the cloud-based datacenter or the one or more other cloud-based datacenters.
9 more elements
A non-transitory computer-readable storage medium having instructions stored thereon associated with controlling a cloud-based datacenter, wherein the instructions, in response to execution by a processor, cause the processor to perform or control performance of operations that comprise:
- obtain first data related to first one or more occurrences of an administrative event associated with first one or more virtual machines associated with first one or more users, wherein the first one or more occurrences of the administrative event are detected by a first hypervisor;
- obtain second data related to second one or more occurrences of the administrative event associated with second one or more virtual machines associated with second one or more users, wherein the second one or more occurrences of the administrative event are detected by a second hypervisor;
- store the first data and the second data in a database;
- determine, based at least on the first data and the second data, that one or more of a number, a frequency, and a distribution of the occurrences of the administrative event exceeds a probability threshold;
- and
- generate, based on the determination that the one or more of the number, the frequency, and the distribution of the occurrences of the administrative event exceeds the probability threshold, an alert that indicates a possible attack on the cloud-based datacenter;
- and
- provide one or more signatures generated for the administrative event based on one or more anomalous characteristics of the administrative event to one or more other datacenters within a same cloud such that the one or more other datacenters are enabled to prevent the attack universally on the cloud prior to identification of a vulnerability of the cloud-based datacenter or of the one or more other data centers.
5 more elements
Dependencies are inferred from the claim text.