Kernel-level monitoring for software applications
The systems and methods disclosed herein monitor application (e.g., artificial intelligence (AI) model) operations using interactions between the application and a kernel. The systems and methods disclosed herein intercept, using a kernel interface, one or more function invocations transmitted from the application (e.g., an AI model without model modification). Event record(s) are generated for one or more functions to define process identifiers, resource interaction types, timestamps, and/or resource identifiers. Observed pattern(s) for the application are identified by comparing current event record(s) with previous record(s), and the identified observed pattern(s) are evaluated against reference pattern(s) to generate score(s). Data packet(s) that indicate observed pattern(s), corresponding score(s), and/or cryptographic digital fingerprint(s) of the one or more functions are generated. The data packet(s) are transmitted to distributed ledgers for immutable storage.
1 . A system for blocking unauthorized artificial intelligence (AI) applications from kernel operations, comprising:
at least one hardware processor; and
at least one non-transitory memory storing instructions, which, when executed by the at least one hardware processor, cause the system to:
intercept, using a kernel interface configured to manage communications with a kernel of an operating system, a function invocation transmitted from an AI application, wherein the function invocation represents a request to execute a function set using the kernel, and wherein the kernel interface comprises an extended Berkeley Packet Filter (eBPF) program;
transform one or more guidelines defining one or more operative boundaries for the AI application into eBPF bytecode from the eBPF program and load the eBPF bytecode into the kernel subsequent to the interception of the function invocation;
evaluate, in the kernel, the guidelines within the eBPF program by:
extracting, from the function invocation, a plurality of application parameters associated with the AI application and an invocation context associated with the function invocation;
comparing the plurality of application parameters associated with the AI application with a plurality of allowable parameters associated with the invocation context, wherein the plurality of allowable parameters define a set of AI applications authorized to invoke the function set and are stored in an eBPF hash map comprising authorized AI applications;
determining, using the comparing, that one or more of the plurality of application parameters does not match corresponding allowable parameters of the plurality of allowable parameters;
in response to a determination that the one or more of the plurality of application parameters does not match the corresponding allowable parameters of the plurality of allowable parameters, blocking the function invocation from being executed; and
generate an event record indicating that the function invocation was blocked, wherein the event record comprises an indication that the one or more of the plurality of application parameters does not match the corresponding allowable parameters of the plurality of allowable parameters.
2 . The system of claim 1 , wherein the system is further caused to:
store the plurality of allowable parameters in a data structure accessible by the kernel; and
retrieve the plurality of allowable parameters from the data structure during the comparing.
3 . The system of claim 1 , wherein the plurality of application parameters include one or more of: a process identifier, a user identifier, a target resource address, or an operation type.
4 . The system of claim 1 , wherein the eBPF program is attached to one or more kernel hook points, and wherein the system is further caused to:
load the eBPF bytecode into the kernel for attachment to the one or more kernel hook points.
5 . The system of claim 1 , wherein blocking the function invocation comprises includes causing transmission of an error code to the AI application prior to execution of the function set.
6 . A non-transitory computer-readable storage medium comprising instructions stored thereon for blocking unauthorized artificial intelligence (AI) applications from kernel operations, wherein the instructions when executed by at least one data processor of a system, cause the system to:
intercept, using a kernel interface configured to manage communications with a kernel of an operating system, a function invocation transmitted from an AI application, wherein the function invocation represents a request to execute a function set using the kernel, and wherein the kernel interface comprises an extended Berkeley Packet Filter (eBPF) program;
transform one or more guidelines defining one or more operative boundaries for the AI application into eBPF bytecode from the eBPF program and load the eBPF bytecode into the kernel subsequent to the interception of the function invocation;
evaluate, in the kernel, the guidelines within the eBPF program by:
extracting, from the function invocation, a plurality of application parameters associated with the AI application and an invocation context associated with the function invocation;
comparing the plurality of application parameters associated with the AI application with an allowable parameter set associated with the invocation context, wherein the allowable parameter set define a set of AI applications authorized to invoke the function set and is stored in an eBPF hash map comprising authorized AI applications;
determining, based on the comparing, that one or more of the plurality of application parameters does not match corresponding allowable parameters of the allowable parameter set;
in response to a determination that the one or more of the plurality of application parameters does not match the corresponding allowable parameters of the allowable parameter set, blocking the function invocation from being executed; and
generate an event indicating that the function invocation was blocked, wherein the event comprises an indication that the one or more of the plurality of application parameters does not match the corresponding allowable parameters of the allowable parameter set.
7 . The non-transitory computer-readable storage medium of claim 6 , wherein the instructions further cause the system to:
receive a guideline set defining one or more operative boundaries for the AI application;
transform the guideline set into a kernel-executable instruction set; and
load the kernel-executable instruction set into the kernel for execution subsequent to intercepting the function invocation.
8 . The non-transitory computer-readable storage medium of claim 6 , wherein the instructions further cause the system to:
apply a digital signature to the event using a key accessible to the kernel; and
store the event with the digital signature in a data structure accessible to the kernel.
9 . The non-transitory computer-readable storage medium of claim 6 , wherein the hash map associates one or more invocation contexts with one or more corresponding sets of authorized AI applications.
10 . The non-transitory computer-readable storage medium of claim 6 , wherein the event is a current event, and wherein the instructions further cause the system to:
generate a cryptographic hash of the current event;
retrieve a previous hash value associated with a previous event generated previous to the current event;
linking the previous hash value with the current event to generate a hash chain; and
transmit the current event and the cryptographic hash to a distributed ledger.
11 . The non-transitory computer-readable storage medium of claim 10 , wherein the distributed ledger is one or more of: a blockchain or a federated ledger.
12 . The non-transitory computer-readable storage medium of claim 6 , wherein the invocation context includes one or more of: a memory access operation, a file I/O operation, or a network operation.
13 . The non-transitory computer-readable storage medium of claim 6 , wherein the eBPF program is attached to one or more kernel hook points.
14 . A computer-implemented method for blocking unauthorized artificial intelligence (AI) applications from kernel operations, the computer-implemented method comprising:
intercepting, using a kernel interface configured to manage communications with a kernel of an operating system, a function invocation transmitted from an AI application, wherein the function invocation represents a request to execute a function set using the kernel, and wherein the kernel interface comprises an extended Berkeley Packet Filter (eBPF) program;
transform one or more guidelines defining one or more operative boundaries for the AI application into eBPF bytecode from the eBPF program and load the eBPF bytecode into the kernel subsequent to the interception of the function invocation;
evaluate, in the kernel, the guidelines within the eBPF program by:
determining, from the function invocation, a plurality of application parameters associated with the AI application and an invocation context associated with the function invocation;
comparing the plurality of application parameters associated with the AI application with an allowable parameter set associated with the invocation context, wherein the allowable parameter set define a set of AI applications authorized to invoke the function set and is stored in an eBPF hash map comprising authorized AI applications;
determining, based on the comparing, that one or more of the plurality of application parameters does not match corresponding allowable parameters of the allowable parameter set;
in response to a determination that the one or more of the plurality of application parameters does not match the corresponding allowable parameters of the allowable parameter set, preventing the function invocation from being executed; and
generating an event indicating that the function invocation was prevented from being executed, wherein the event comprises an indication that the one or more of the plurality of application parameters does not match the corresponding allowable parameters of the allowable parameter set.
15 . The computer-implemented method of claim 14 ,
wherein the AI application includes an autonomous or semi-autonomous AI agent, and
wherein the AI agent is configured to autonomously trigger one or more actions including one or more of: an application programming interface (API) invocation, an outbound network request, or an updates to a datastore.
16 . The computer-implemented method of claim 14 , further comprising:
intercepting, from each of a plurality of AI applications executing on the operating system, a respective function invocation;
comparing, for each of the plurality of AI applications, respective application parameters with the allowable parameter set; and
selectively blocking one or more of the plurality of AI applications based on respective application parameters failing to match respective corresponding allowable parameters of the allowable parameter set.
17 . The computer-implemented method of claim 14 , wherein the AI application is executed within a sandbox environment.
18 . The computer-implemented method of claim 14 , further comprising:
generating a cryptographic attestation of the event by applying a digital signature to the event; and
transmitting the cryptographic attestation to a blockchain as a transaction within a block of the blockchain.
19 . The computer-implemented method of claim 14 , further comprising:
generating an audit record including one or more of: the event, a timestamp associated with the event, or the plurality of application parameters; and
maintaining the audit record in a data structure that links each audit record to a previous audit record via a cryptographic hash.
20 . The computer-implemented method of claim 19 , further comprising:
constructing a Merkle tree over a batch of audit records by applying one or more hash operations to each audit record to generate a plurality of hash values, and maintaining a representation of at least one hash value within a distributed ledger.