# US 9,882,920 B2 · Cross-user correlation for detecting server-side multi-target intrusion

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,882,920 B2
- Document ID: US9882920B2
- Status: Granted
- Kind: B2
- Application number: 14/873,169
- Filed: 2015-10-01
- Published: 2016-01-28
- Granted: 2018-01-30
- Earliest claimed: 2015-10-01
- Assignees: Empire Technology Development LLC
- Applicants: Empire Technology Development LLC
- Inventors: Ezekiel Kruglick
- Web page: https://patentgrep.com/patent/US9882920B2

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/554: {involving event detection and direct action}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- H04L 63/105: {Multiple levels of security}
- H04L 63/14: {for detecting or protecting against malicious traffic}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1458: {Denial of Service}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2221/2101: Auditing as a secondary aspect
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Technologies are generally described for time-correlating administrative events within virtual machines of a datacenter across many users and/or deployments. In some examples, the correlation of administrative events enables the detection of confluences of repeated unusual events that may indicate a mass hacking attack, thereby allowing attacks kicking network signatures to be detected. Detection of the attack may also allow the repair of affected systems and the prevention of further hacking before the vulnerability has been analyzed or repaired.

## Claims

### Claim 1

A method implemented at a datacenter to detect server-side multi-target intrusions, the method comprising:
receiving first data related to first one or more occurrences of an administrative event associated with first one or more virtual machines associated with first one or more users, wherein the first one or more occurrences of the administrative event are detected by a first hypervisor;
receiving second data related to second one or more occurrences of the administrative event associated with second one or more virtual machines associated with second one or more users, wherein the second one or more occurrences of the administrative event are detected by a second hypervisor;
storing the first data and the second data in a database;
determining, based at least on the first data and the second data, that a number or frequency of occurrences of the administrative event exceeds a probability threshold; and
generating, based on the determination that the number or frequency of the occurrences of the administrative event exceeds the probability threshold, an alert that indicates a possible attack on the datacenter, wherein:
determining, based on the first data and the second data, that the number or frequency of occurrences of the administrative event exceeds the probability threshold facilitates cross-deployment or cross-user correlation of the administrative event across multiple deployments or users,
generating the alert facilitates prevention of another attack on the datacenter before one of analysis or repair of a vulnerability of the datacenter, and
the alert generated based on the determination indicates an alert which represents a higher likelihood of the possible attack on the datacenter when compared to another alert generated in absence of the cross-deployment or cross-correlation of the administrative event.

### Claim 2 (depends on 1)

The method of claim 1, wherein the administrative event is on a list of watched events.

### Claim 3 (depends on 2)

The method of claim 2, wherein the list of watched events includes a list of low-probability events.

### Claim 4 (depends on 1)

The method of claim 1, wherein the administrative event includes an elevation in privilege.

### Claim 5 (depends on 1)

The method of claim 1, wherein the administrative event includes a change to a user status.

### Claim 6 (depends on 1)

The method of claim 1, wherein the administrative event includes a change to a file associated with a user.

### Claim 7 (depends on 1)

The method of claim 1, wherein the administrative event includes a replacement of an executable file associated with a user.

### Claim 8 (depends on 1)

The method of claim 1, wherein determining that the number or frequency of occurrences of the administrative event exceeds the probability threshold includes determining that the number or frequency of occurrences of the administrative event exceeds the probability threshold within a particular period of time.

### Claim 9 (depends on 1)

The method of claim 1, further comprising:
determining, based at least on the first data and the second data, that a distribution of occurrences of the administrative event over another period of time exceeds another probability threshold; and
generating, based on the determination that the distribution of the occurrences of the administrative event exceeds the another probability threshold, the alert that indicates the possible attack on the datacenter.

### Claim 10

A cloud-based datacenter, comprising:
a plurality of virtual machines operable to be executed on one or more physical machines;
one or more virtual machine monitors configured to:
provide access to the plurality of virtual machines; and
detect an administrative event associated with one or more users, wherein the administrative event is a low probability event under no-attack conditions; and
a datacenter controller configured to:
monitor occurrences of the administrative event within the plurality of virtual machines of the datacenter through the one or more virtual machine monitors across multiple users and/or deployments;
determine that one or more of a number, a frequency, and a distribution of the occurrences of the administrative event exceeds a probability threshold;
generate, based on the determination that the one or more of the number, the frequency, and the distribution of the occurrences of the administrative event exceeds the probability threshold, an alert that indicates a possible attack on the datacenter; and
share one or more signatures generated for the administrative event with one or more other cloud-based datacenters such that the one or more other cloud-based datacenters are enabled to prevent attacks before detection of a vulnerability of at least one of the cloud-based datacenter or the one or more other cloud-based datacenters.

### Claim 11 (depends on 10)

The cloud-based datacenter of claim 10, wherein the administrative event is a list of watched events.

### Claim 12 (depends on 10)

The cloud-based datacenter of claim 10, wherein the administrative event includes one or more of a change to a user status, a change to a file associated with the user status, a replacement of an executable file associated with a user, and/or a change to a data file associated with the user.

### Claim 13 (depends on 10)

The cloud-based datacenter of claim 10, wherein the administrative event includes a permission change.

### Claim 14 (depends on 10)

The cloud-based datacenter of claim 10, wherein the administrative event includes a super-user addition within a virtual machine of the plurality of virtual machines.

### Claim 15 (depends on 10)

The cloud-based datacenter of claim 10, wherein the one or more virtual machine monitors are further configured to store information indicative of the occurrences of the administrative event in a database.

### Claim 16 (depends on 10)

The cloud-based datacenter of claim 10, wherein the datacenter controller is further configured to generate, based on the determination that the one or more of the number, the frequency, and the distribution of the occurrences of the administrative event across the multiple users and/or deployments exceeds the probability threshold, an alert that indicates a possible mass attack.

### Claim 17

A non-transitory computer-readable storage medium having instructions stored thereon associated with controlling a cloud-based datacenter, wherein the instructions, in response to execution by a processor, cause the processor to perform or control performance of operations that comprise:
obtain first data related to first one or more occurrences of an administrative event associated with first one or more virtual machines associated with first one or more users, wherein the first one or more occurrences of the administrative event are detected by a first hypervisor;
obtain second data related to second one or more occurrences of the administrative event associated with second one or more virtual machines associated with second one or more users, wherein the second one or more occurrences of the administrative event are detected by a second hypervisor;
store the first data and the second data in a database;
determine, based at least on the first data and the second data, that one or more of a number, a frequency, and a distribution of the occurrences of the administrative event exceeds a probability threshold; and
generate, based on the determination that the one or more of the number, the frequency, and the distribution of the occurrences of the administrative event exceeds the probability threshold, an alert that indicates a possible attack on the cloud-based datacenter; and
provide one or more signatures generated for the administrative event based on one or more anomalous characteristics of the administrative event to one or more other datacenters within a same cloud such that the one or more other datacenters are enabled to prevent the attack universally on the cloud prior to identification of a vulnerability of the cloud-based datacenter or of the one or more other data centers.

### Claim 18 (depends on 17)

The non-transitory computer-readable storage medium of claim 17, wherein the administrative event is on a list of watched low-probability events.

### Claim 19 (depends on 17)

The non-transitory computer-readable storage medium of claim 17, wherein the administrative event includes an elevation in privilege.

### Claim 20 (depends on 19)

The non-transitory computer-readable storage medium of claim 19, wherein the elevation in privilege includes elevation of at least one of the first one or more users and the second one or more users to a super-user.