Tracking virtual processes to identify anomalies
A virtualization pattern is learned. The learned virtualization pattern comprises information associated with one or more virtualized processes. For example, the virtualization pattern may comprise the creation of a first micro service and the spawning of a second micro service from the first micro service. The learned virtualization pattern is compared to a current virtualization pattern to identify an anomalous virtualization pattern in the current virtualization pattern. In response to identifying the anomalous virtualization pattern in the current virtualization pattern, an action is taken. For example, the action taken may be to quarantine a virtual process, to unload the virtual process, to quarantine a tenant partition, and/or the like.
1 . A system comprising:
a microprocessor; and
a computer readable medium, coupled with the microprocessor and comprising microprocessor readable and executable instructions that, when executed by the microprocessor, cause the microprocessor to:
monitor temporal flows in a network to provide information describing temporal flows of creating, spawning, using, and/or deleting of a plurality of virtualized resources, the network comprising a plurality of tenants, each tenant being associated with a respective tenant partition, and a cloud service associated with a cloud partition comprising a plurality of virtualized resources, the plurality of virtualized resources being shared by tenant partitions of the plurality of tenants;
based on the information describing temporal flows of creating, spawning, using, and/or deleting of the plurality of virtualized resources, learn tenant and cloud virtualization patterns to provide learned tenant and cloud virtualization patterns, respectively, the learned tenant virtualization patterns describing temporal flows within each tenant partition of the plurality of tenants and the learned cloud virtualization pattern describing temporal flows between the plurality of tenants and the cloud service, the learned tenant and cloud virtualization patterns being different from each other;
compare each of the learned tenant virtualization patterns to a current tenant virtualization pattern and the learned cloud virtualization pattern to a current cloud service virtualization pattern to identify an anomalous virtualization pattern in the current tenant and cloud virtualization patterns; and
in response to identifying the anomalous virtualization pattern, take an action.
2 . The system of claim 1 , wherein the plurality of resources comprise one or more of a database, disk space, and network resource and the plurality of virtualized resources comprise one or more of a service, micro service, container, and virtual machine, and wherein the information comprises one or more of usage of a virtualized resource, a change in an attribute of the virtualized resource, and a port attribute change associated with the virtualized resource.
3 . The system of claim 2 , wherein the anomalous virtualization pattern comprises one or more of the plurality of virtualized resources and a malicious virtualized resource monitoring an operation of the one or more of the plurality of virtualized resources, the operation comprising one or more of accessing, interacting with, monitoring information received and/or transmitted by, initiating and/or monitoring a connection with, and/or making a function call to the one or more of the plurality of virtualized resources, and wherein the anomalous virtualization pattern is indicative of a progressive breach of the cloud service comprising one of:
a first breach of a tenant premise partition and a first breach of a cloud partition; and
a second breach of the cloud partition and a second breach of the tenant premise partition.
4 . The system of claim 2 , wherein the anomalous virtualization pattern comprises one or more of the plurality of virtualized resources and a malicious virtualized resource monitoring an operation of the one or more of the plurality of virtualized resources, the operation comprising one or more of accessing, interacting with, monitoring information received and/or transmitted by, initiating and/or monitoring a connection with, and/or making a function call to the one or more of the plurality of virtualized resources, and wherein the anomalous virtualization pattern is a progressive breach of the cloud service comprising: a first breach of a first tenant partition and a second breach of a second tenant partition.
5 . The system of claim 2 , wherein the anomalous virtualization pattern comprises one or more of the plurality of virtualized resources and a malicious virtualized resource monitoring an operation of the one or more of the plurality of virtualized resources, the operation comprising one or more of accessing, interacting with, monitoring information received and/or transmitted by, initiating and/or monitoring a connection with, and/or making a function call to the one or more of the plurality of virtualized resources, and wherein identifying the anomalous virtualization pattern comprises tracking how an anomalous virtual process interacts with another virtual process in the cloud service.
6 . The system of claim 5 , wherein the service is associated with a plurality of different learned virtualization patterns and wherein identifying the anomalous virtualization pattern further comprises tracking anomalous resource usage in another virtual process in the cloud service.
7 . The system of claim 5 , wherein tracking how the anomalous virtual process interacts with the another virtual process in the cloud service comprises tracking at least one of how the anomalous virtual process: monitors data passed between a plurality of other virtual processes, spawns a new virtual process, and identifies one or more access privileges between the plurality of other virtual processes.
8 . The system of claim 1 , wherein each of the plurality of tenants is associated with a different learned tenant virtualization pattern, wherein in the comparing the different learned tenant virtualization patterns of the plurality of tenants is compared to the current tenant virtualization pattern of each of the plurality of tenants to identify the anomalous virtualization pattern in the current tenant virtualization pattern, and wherein the cloud service comprises a common cloud virtual process.
9 . The system of claim 8 , wherein identifying the anomalous virtualization pattern comprises one of:
identifying the anomalous virtualization pattern based on the common cloud virtual process;
identifying the anomalous virtualization pattern based on an individual one of a plurality of tenant partitions;
identifying a first progressive breach of the cloud service comprising: a first breach of the common cloud virtual process and a first breach of the individual one of the plurality of tenant partitions; and
identifying a second progressive breach of the cloud service comprising: a second breach of the individual one of the plurality of tenant partitions and a second breach of the common cloud virtual process.
10 . The system of claim 1 , wherein the information comprises a plurality of a load or unload parameter, a virtualized resource usage, time, date, number of threads created, applications loaded or unloaded in a container and/or virtual machine, wherein the action comprises one or more of: quarantining a virtual process, unloading the virtual process, storing a virtual process image, changing access privileges of the virtual process, quarantining a tenant partition, quarantining a common cloud virtual process, logging out a user, blocking a port on a firewall, blocking access to a common database, and blocking network access for the virtual process.
11 . A method comprising:
monitoring temporal flows in a network to provide information describing temporal flows of creating, spawning, using, and/or deleting of a plurality of virtualized resources, the network comprising a plurality of tenants, each tenant being associated with a respective tenant partition, and a cloud service associated with a cloud partition comprising a plurality of resources and the plurality of virtualized resources shared by tenant partitions of the plurality of tenants;
based on the information describing temporal flows of creating, spawning, using, and/or deleting of the plurality of virtualized resources, learning, by a microprocessor, a tenant and cloud virtualization patterns to provide learned tenant and cloud virtualization patterns, respectively, the learned tenant virtualization patterns describing temporal flows within each tenant partition of the plurality of tenants and the learned cloud virtualization pattern describing temporal flows between the plurality of tenants and the cloud service, the learned tenant and cloud virtualization patterns being different from each other;
comparing, by the microprocessor, each of the learned tenant virtualization patterns to a current tenant virtualization pattern and the learned cloud virtualization pattern to a current cloud service virtualization pattern to identify an anomalous virtualization pattern in the current tenant and cloud virtualization patterns; and
in response to identifying the anomalous virtualization pattern, selecting, by the microprocessor, an action for implementation.
12 . The method of claim 11 , wherein the plurality of resources comprise one or more of a database, disk space, and network resource and the plurality of virtualized resources comprise one or more of a service, micro service, container, and virtual machine, and wherein the information describing temporal flows of creating, spawning, using, and/or deleting of the plurality of virtualized resources comprises one or more of usage of a virtualized resource, a change in an attribute of the virtualized resource, and a port attribute change associated with the virtualized resource.
13 . The method of claim 12 , wherein the anomalous virtualization pattern comprises one or more of the plurality of virtualized resources and a malicious virtualized resource monitoring an operation of the one or more of the plurality of virtualized resources, the operation comprising one or more of accessing, interacting with, monitoring information received and/or transmitted by, initiating and/or monitoring a connection with, and/or making a function call to the one or more of the plurality of virtualized resources, and wherein the anomalous virtualization pattern is indicative of a progressive breach of the cloud service comprising one of:
a first breach of a tenant premise partition and a first breach of a cloud partition; and
a second breach of the cloud partition and a second breach of the tenant premise partition.
14 . The method of claim 12 , wherein the anomalous virtualization pattern comprises one or more of the plurality of virtualized resources and a malicious virtualized resource monitoring an operation of the one or more of the plurality of virtualized resources, the operation comprising one or more of accessing, interacting with, monitoring information received and/or transmitted by, initiating and/or monitoring a connection with, and/or making a function call to the one or more of the plurality of virtualized resources, and wherein the anomalous virtualization pattern is a progressive breach of the cloud service comprising: a first breach of a first tenant partition and a second breach of a second tenant partition.
15 . The method of claim 12 , wherein the anomalous virtualization pattern comprises one or more of the plurality of virtualized resources and a malicious virtualized resource impacting an operation of the one or more of the plurality of virtualized resources, the operation comprising one or more of accessing, interacting with, monitoring information received and/or transmitted by, initiating and/or monitoring a connection with, and/or making a function call to the one or more of the plurality of virtualized resources, and wherein identifying the anomalous virtualization pattern comprises tracking how an anomalous virtual process interacts with another virtual process in the cloud service.
16 . The method of claim 15 , wherein the service is associated with a plurality of different learned virtualization patterns and wherein identifying the anomalous virtualization pattern further comprises tracking anomalous resource usage in the another virtual process in the cloud service.
17 . The method of claim 15 , wherein the information comprises a plurality of a load or unload parameter, a virtualized resource usage, time, date, number of threads created, applications loaded or unloaded in a container and/or virtual machine, and wherein tracking how the anomalous virtual process interacts with the another virtual process in the cloud service comprises tracking at least one of how the anomalous virtual process: monitors data passed between a plurality of other virtual process, spawns a new virtual process, and identifies one or more access privileges between a plurality of other virtual processes.
18 . The method of claim 11 , wherein each of the plurality of tenants is associated with a different learned virtualization pattern, wherein in the comparing the different learned tenant virtualization patterns of the plurality of tenants is compared to the current tenant virtualization pattern of each of the plurality of tenants to identify the anomalous virtualization pattern in the current tenant virtualization pattern, and the cloud service comprises a common cloud virtual process.
19 . The method of claim 18 , wherein identifying the anomalous virtualization pattern comprises one of:
identifying the anomalous virtualization pattern based on the common cloud virtual process;
identifying the anomalous virtualization pattern based on an individual one of a plurality of tenant partitions;
identifying a first progressive breach of the cloud service comprising: a first breach of the common cloud virtual process and a first breach of the individual one of the plurality of tenant partitions; and
identifying a second progressive breach of the cloud service comprising: a second breach of the individual one of the plurality of tenant partitions and a second breach of the common cloud virtual process.
20 . A non-transient computer readable medium having stored thereon instructions that cause a processor to execute a method, the method comprising instructions to:
monitor temporal flows in a network to provide information describing temporal flows of creating, spawning, using, and/or deleting of a plurality of virtualized resources, the network comprising a plurality of tenants, each tenant being associated with a respective tenant partition, and a cloud service associated with a cloud partition comprising a plurality of virtualized resources, the plurality of virtualized resources being shared by tenant partitions of the plurality of tenants;
based on the information describing temporal flows of creating, spawning, using, and/or deleting of the plurality of virtualized resources, learn tenant and cloud virtualization patterns to provide learned tenant and cloud virtualization patterns, respectively, the learned tenant virtualization patterns describing temporal flows within each tenant partition of the plurality of tenants and the learned cloud virtualization pattern describing temporal flows between the plurality of tenants and the cloud service, the learned tenant and cloud virtualization patterns being different from each other;
compare each of the learned tenant virtualization patterns to a current tenant virtualization pattern and the learned cloud virtualization pattern to a current cloud service virtualization pattern to identify an anomalous virtualization pattern in the current tenant and cloud virtualization patterns, wherein the anomalous virtualization pattern comprises one or more of the plurality of virtualized resources and a malicious virtualized resource impacting an operation of the one or more of the plurality of virtualized resources, the operation comprising one or more of accessing, interacting with, monitoring information received and/or transmitted by, initiating and/or monitoring a connection with, and/or making a function call to the one or more of the plurality of virtualized resources; and
in response to identifying the anomalous virtualization pattern in the current tenant and cloud virtualization patterns, select an action for implementation.