Behavioral threat detection definition and compilation
Examples of the present disclosure describe systems and methods for behavioral threat detection definition compilation. In an example, one or more sets of rule instructions may be packaged for distribution and/or use by a behavioral threat detection engine. As an example, a set of rule instructions is compiled into an intermediate language and assembled in to a compiled behavior rule binary. Event linking is performed, wherein other rules launched by the rule and/or events that launch the rule or are processed by the rule are identified, and such information may be stored accordingly. The behavior rule binary may be packaged with other rules associated with identifying a specific behavior. The packaged behavior rule is distributed to one or more computing devices for use with a behavioral threat detection engine. For example, the threat detection engine may execute the behavior rule using a rule virtual machine.
1 . A system, comprising:
a processor; and
a non-transitory computer readable medium, comprising instructions for:
determining a set of events, where each of the set of events is associated with one or more behavior rules;
monitoring for the set of events;
determining a first event of the set of events has occurred; and
executing a first rule virtual machine for processing the first event, the first rule virtual machine adapted to execute a behavior rule binary comprising instructions to implement a behavior rule associated with the first event, wherein executing the first rule virtual machine includes:
duplicating the first rule virtual machine, including a rule execution state of the first rule virtual machine, in response to determining that a second event of the set of events has occurred,
wherein subsequent to the duplicating, a first instance of the first rule virtual machine resumes execution of the behavior rule binary and a second instance of the first rule virtual machine waits for additional events of the set of events.
2 . The system of claim 1 , wherein each of the set of events is associated with a context and the monitoring for the set of events comprises, for each of the set of events monitoring the context associated with that event to determine if that event has occurred in that context.
3 . The system of claim 1 , wherein the behavior rule binary was generated from the associated behavior rule by obtaining rule instructions associated with the associated behavior rule, generating an intermediate language output from the behavior rule instruction and compiling the intermediate language output to generate the behavior rule binary.
4 . The system of claim 3 , wherein the rule instructions are in a domain specific language.
5 . The system of claim 1 , wherein the instructions are further for: maintaining a rule execution state of the first rule virtual machine.
6 . A method, comprising:
determining a set of events, where each of the set of events is associated with one or more behavior rules;
monitoring for the set of events;
determining a first event of the set of events has occurred; and
executing a first rule virtual machine for processing the first event, the first rule virtual machine adapted to execute a behavior rule binary comprising instructions to implement a behavior rule associated with the first event, wherein executing the first rule virtual machine includes:
duplicating the first rule virtual machine, including a rule execution state of the first rule virtual machine, in response to determining that a second event of the set of events has occurred,
wherein subsequent to the duplicating, a first instance of the first rule virtual machine resumes execution of the behavior rule binary and a second instance of the first rule virtual machine waits for additional events of the set of events.
7 . The method of claim 6 , wherein each of the set of events is associated with a context and the monitoring for the set of events comprises, for each of the set of events monitoring the context associated with that event to determine if that event has occurred in that context.
8 . The method of claim 6 , wherein the behavior rule binary was generated from the associated behavior rule by obtaining rule instructions associated with the associated behavior rule, generating an intermediate language output from the behavior rule instruction and compiling the intermediate language output to generate the behavior rule binary.
9 . The method of claim 8 , wherein the rule instructions are in a domain specific language.
10 . The method of claim 6 , further comprising maintaining a rule execution state of the first rule virtual machine.
11 . A non-transitory computer readable medium, comprising instructions for:
determining a set of events, where each of the set of events is associated with one or more behavior rules;
monitoring for the set of events;
determining a first event of the set of events has occurred; and
executing a first rule virtual machine for processing the first event, the first rule virtual machine adapted to execute a behavior rule binary comprising instructions to implement a behavior rule associated with the first event, wherein executing the first rule virtual machine includes:
duplicating the first rule virtual machine, including a rule execution state of the first rule virtual machine, in response to determining that a second event of the set of events has occurred,
wherein subsequent to the duplicating, a first instance of the first rule virtual machine resumes execution of the behavior rule binary and a second instance of the first rule virtual machine waits for additional events of the set of events.
12 . The non-transitory computer readable medium of claim 11 , wherein each of the set of events is associated with a context and the monitoring for the set of events comprises, for each of the set of events monitoring the context associated with that event to determine if that event has occurred in that context.
13 . The non-transitory computer readable medium of claim 11 , wherein the behavior rule binary was generated from the associated behavior rule by obtaining rule instructions associated with the associated behavior rule, generating an intermediate language output from the behavior rule instruction and compiling the intermediate language output to generate the behavior rule binary.
14 . The non-transitory computer readable medium of claim 13 , wherein the rule instructions are in a domain specific language.
15 . The non-transitory computer readable medium of claim 11 , wherein the instructions are further for: maintaining a rule execution state of the first rule virtual machine.