Techniques for modeling and evaluating protocol interactions

1. A method implemented in a non-transitory machine-readable medium and to execute on a proxy, the method comprising:

monitoring, by the proxy, a service for interactions with given network protocol;

deriving, by the proxy, one or more behavior vectors for the service with respect to the given protocol;

comparing, by the proxy, additional activity of the service for the given protocol against the one or more behavior vectors; and

determining, by the proxy, whether the additional activity falls within a desired threshold for the service, the one or more behavior vectors represents a sub set of behaviors or actions that exist for a given network protocol ontology assigned to the given network protocol, the given network protocol ontology defines behavior semantics of a given communication language that is the given network protocol, the behavior semantics define a sub set of permissible commands, parameters, and interactions of parties using the given communication language, the one or more behavior vectors are automatically derived from the given network protocol ontology after observing actions of the parties with respect to the given network protocol over a period of time, the given network protocol ontology defines a semantic space or universe for the given network protocol in a formal manner, each behavior vector is mapped to a point in the semantic space and the additional activity is also mapped to another point in the semantic space, any two points in the semantic space are subtracted to obtain a semantic distance that is compared to the desired threshold to determine when the additional activity is permissible, impermissible, and suspect.

2. The method of claim 1 , wherein deriving further includes controlling actions or an environment of the service with respect to the given protocol while deriving the one or more behavior vectors.

3. The method of claim 2 , wherein deriving further includes establishing reference activity for the service and the given protocol with the one or more behavior vectors, wherein a number of the behavior vectors define permissible behavior for the service and other of the behavior vectors define impermissible behavior for the service.

4. The method of claim 1 further comprising, deriving, by the proxy, one or more gestalt behavior vectors that define interactions of the service for the given protocol with one or more additional protocols.

5. The method of claim 4 further comprising, comparing, by the proxy, the additional activity of the service for the given protocol and the one or more additional protocols against the one or more gestalt behavior vectors.

6. The method of claim 1 , wherein determining further includes evaluating a policy specification in view of the additional activity and activities represented in the one or more behavior vectors to acquire the desired threshold.

7. A method implemented in a non-transitory machine-readable medium and to execute on a proxy, the method comprising:

detecting, by the proxy, activity between a service and a resource over a network;

identifying, by the proxy, one or more protocols in use for the activity;

acquiring, by the proxy, one or more reference behavior vectors that define known permissible and impermissible activities for the one or more protocols; and

evaluating, by the proxy, the activity in view of the known permissible and impermissible activities defined in the one or more reference behavior vectors, the one or more reference behavior vectors represents a sub set of behaviors or the known permissible and impermissible activities that exist for a given network protocol ontology assigned to a given network protocol, the given network protocol ontology defines behavior semantics of a given communication language that is the given network protocol, the behavior semantics define permissible and impermissible commands, parameters, and interactions of service and the resource using the given communication language, the one or more reference behavior vectors are automatically derived from the given network protocol ontology after observing actions of parties with respect to the given network protocol over a period of time, the given network protocol ontology defines a semantic space or universe for the given network protocol in a formal manner, each behavior vector is mapped to a point in the semantic space and the activity is also mapped to another point in the semantic space, any two points in the semantic space are subtracted to obtain a semantic distance that is compared to a desired threshold to determine when the activity is permissible, impermissible, and suspect.

8. The method of claim 7 further comprising at least one of:

allowing, by the proxy, the activity;

blocking, by the proxy, the activity if the evaluation identifies deviant behavior;

notifying, by the proxy, a different resource if the evaluation identifies the activity as suspect behavior; and

logging, by the proxy, the activity.

9. The method of claim 7 , wherein acquiring further includes identifying a number of the reference behavior vectors as global vectors defining subsets of interactions between various ones of the one or more protocols and identifying other ones of the reference behavior vectors as local vectors defining specific ones of the one or more protocols.

10. The method of claim 7 , wherein acquiring further includes identifying a number of the reference behavior vectors as permissible behavior for the service and identifying others of the reference behavior vectors as known impermissible behavior for the service.

11. A system, comprising:

a behavior ontology service implemented in a machine-readable medium and to execute on a proxy;

a reference behavior vector service implemented in a machine-readable medium and to execute on the proxy; and

an activity monitoring service implemented in a machine-readable medium and to execute on the proxy, the behavior ontology service is to build semantic definitions of protocols that define permissible and impermissible commands, parameters, and interactions of a service and a resource using communication languages that are the protocols, and the reference behavior vector service is to automatically derive reference behavior vectors in response to observed activities between the service and the resource over a network and in response to the semantic definitions, and the activity monitoring service is evaluate runtime activities between the service and the resource over the network in view of the reference behavior vectors to selective allow and deny the interactions between the service and the resource, the semantic definitions for the protocols define a semantic space or universe for the protocols in a formal manner, each reference behavior vector is mapped to a point in the semantic space and the observed activities are also mapped to other points in the semantic space, any two points in the semantic space are subtracted to obtain a semantic distance that is compared to a desired threshold to determine when the observed activities are permissible, impermissible, and suspect.

12. The system of claim 11 , wherein the behavior ontology service is to build the semantic definitions in response to observing activities of at least one of the service and the protocols to which the semantic definitions relate.

13. The system of claim 11 , wherein the reference behavior vector service is to derive the reference behavior vectors by monitoring controlled interactions between the service and the resource.

14. The system of claim 11 , wherein the reference behavior vector service is to derive a number of the reference behavior vectors as permissible behaviors for the service and others of the reference behavior vectors as impermissible behaviors for the service.