Method for monitoring and enforcing secure policies in a device

1 . A method for monitoring and enforcing secure policies in a device, the device comprising a data storage having an operating system residing and being installed therein, the method comprising the steps of:

a) providing at least one packet filtering module residing in a user space of the operating system, the packet filtering module being configured to directly read and collect kernel data from a kernel space of the operating system and convert the collected kernel data into one or more corresponding events, the packet filtering module comprising an enhanced Berkeley Packet Filter;

b) providing a data bus that resides in the user space of the operating system and is in signal communication with the at least one packet filtering module to receive events from the packet filtering module, the data bus being configured to store the received events;

c) providing a plurality of secure policies residing in the user space of the operating system, each secure policy comprising a set of executable actions or commands;

d) providing at least one policy enforcement module that resides in the user space of the operating system and is in signal communication with the data bus to receive events from the data bus, the policy enforcement module being configured to execute one or more secure policy in the device, wherein the packet filtering module, the data bus, and the policy enforcement module define an embedded security architecture operating entirely within the user space;

e) collecting kernel data from the kernel space by the packet filtering module;

f) processing and converting collected kernel data by the packet filtering module into one or more corresponding events, each event comprising at least one of a header and a payload relating to predetermined information of collected kernel data;

g) transmitting one or more events to the data bus by the packet filtering module, g′) storing the one or more events in the data bus and g″) transmitting the one or more events to the policy enforcement module by the data bus;

h) monitoring the device by evaluating events and identifying one or more threat events by the policy enforcement module, the policy enforcement module comprising an evaluating algorithm configured to receive events and the plurality of secure policies as input, evaluate the received events, identify threat events and one or more corresponding secure policies on the basis of the identified threat events, wherein the evaluating algorithm resides and operates autonomously on the device;

i) identifying in real time one or more secure policies from the plurality of secure policies by the policy enforcement module if a threat event is identified by the evaluating algorithm;

j) enforcing the identified secure policies by the policy enforcement module.

2 . The method according to claim 1 , wherein:

the at least one packet filtering module comprises at least one virtual probe, the virtual probe being configured to read and collect kernel data, and

the virtual probe is associated with a corresponding activity of the operating system, the activity relating to one of networking, traffic patterns, filesystem, processes, device activities and system calls.

3 . The method according to claim 2 , wherein the step of a) providing at least one packet filtering module comprises the sub-step of providing a′) a plurality of packet filtering modules, each comprising a respective virtual probe associated with a corresponding activity to be monitored.

4 . The method according to claim 1 , wherein the step of e) processing and converting collected kernel data into one or more events comprises the sub-step of e′) generating for each event at least one of a header and a payload as a function of corresponding collected kernel data, and wherein:

the header of the event comprises one or more of timestamp, event type, source module, string or image relating the event, threat flag;

the payload of the event comprises one or more of path of the file, path of the directory, permission set, IP address, port of the source or destination, TPC connection, length of the packet, DNS questions, DNS answers, number or list of arguments passed to the executable.

5 . The method according claim 1 , wherein the evaluating algorithm of the policy enforcement module comprises an algorithm based on Domain Specific Language Rules, each DSL rule comprising a corresponding condition to be verified.

6 . The method according to claim 5 , wherein the step of h) monitoring the device comprises the sub-steps of:

h-1) comparing the events with one or more conditions of the DLS Rules,

h-2) generating a condition output as a function of the comparison, the condition output comprising at least one of positive and negative condition output,

h-3) generating a threat flag for the corresponding event and marking the event as threat event for a positive condition output,

h-4) identifying at least one corresponding secure policy for the threat event.

7 . The method according to claim 5 , wherein the step of j) enforcing the identified secure policy comprising the sub-steps of:

j-1) evaluating the condition output and enforcing the identified secure policy for positive condition outputs, or

j-1′) evaluating the score output and enforcing the identified secure policy for score outputs above the predetermined threshold.

8 . The method according to claim 1 , wherein the evaluating algorithm comprises a supervised or semi-supervised machine learning algorithm, the machine learning algorithm comprising one of neural network algorithm, random forest algorithm, ensemble algorithm.

9 . The method according to claim 8 , wherein the step of h) monitoring the device comprises the sub-steps of:

h-1′) generating a score output for each event,

h-2′) generating a threat flag for the corresponding event and marking the event as threat event for scores above a predetermined threshold,

h-3′) identify at least one corresponding secure policy for the threat event.