Method for identifying undesirable features among computing nodes
View Patent ↗One embodiment of the present invention provides a system for identifying undesirable features in a network of computers. During operation, the system detects an anomaly associated with a node in the network. Next, the system identifies one or more features which are associated with the anomaly. The system then updates the identified features. Next, the system communicates the information corresponding to updated features to at least one other node in the network. The system then receives information indicating a correlation between the updated features and the anomaly from at least one other node in the network. Next, the system correlates the updated features with the anomaly based on the received information. The system subsequently produces a result which indicates a correlation between the updated features and the anomaly.
1. A computer-executed method for identifying an undesirable feature in a network of computing nodes, comprising:
detecting an anomaly associated with a node in the network, wherein the anomaly includes an abnormal state or configuration of the node;
identifying one or more features which are associated with the anomaly;
updating the identified features;
sending a comment-soliciting request to at least one other node in the network, wherein the comment-soliciting request specifies the anomaly and the updated features;
receiving, from at least one other node in the network, information indicating whether the at least one other node experienced a correlation between a first feature of the updated features and the anomaly;
correlating the first feature with the anomaly based on the received information; and
producing a result which indicates a correlation between the first feature and the anomaly.
2. The method of claim 1 , wherein updating the identified features comprises removing, from the identified features, a second feature that has not changed since a pre-specified state associated with the node.
3. The method of claim 1 , wherein updating the identified features comprises adding a second feature based on a policy.
4. The method of claim 1 , wherein updating the features comprises removing a second feature whose occurrence frequency in the network of computing nodes is above a pre-specified threshold.
5. The method of claim 1 , further comprising:
determining a measure of association between the first feature and a non-malicious process; and
communicating the measure and the first feature to at least one other node in the network.
6. The method of claim 1 , further comprising:
receiving at a node a measure and a second feature, wherein a sender of the measure and the second feature has determined a measure of association between the second feature and a non-malicious process; and
controlling, based on the measure, one or more of: creating, reading, updating, deleting, and executing of the second feature at the node.
7. The method of claim 1 , wherein the first feature is associated with one or more of a file, a machine state, a communication port, a network state, a memory location, and a registry entry.
8. The method of claim 7 , wherein the first feature indicates one or more of:
name or identifier;
creation time;
modification history;
access history;
content;
location;
owner;
creator;
access privilege;
type;
visibility;
security;
data integrity scheme;
suffix;
protection;
usage;
origin;
version;
checksum;
cryptographic checksum;
call graph; and
a change in the features.
9. An apparatus for identifying an undesirable feature in a network of computing nodes, comprising:
a processor;
a memory;
a detecting mechanism configured to detect an anomaly associated with a node in the network, wherein the anomaly includes an abnormal state or configuration of the node;
an identification mechanism configured to identify one or more features which are associated with the anomaly;
an updating mechanism configured to update the identified features;
a communicating mechanism configured to send a comment-soliciting request to at least one other node in the network, wherein the comment-soliciting request specifies the anomaly and the updated features;
a receiving mechanism configured to receive, from at least one other node in the network, information indicating whether the at least one other node experienced a correlation between a first feature of the updated features and the anomaly;
a correlating mechanism configured to correlate the first feature with the anomaly based on the received information; and
a producing mechanism configured to produce a result which indicates a correlation between the first feature and the anomaly.
10. The apparatus of claim 9 , wherein while updating the identified features the updating mechanism is configured to remove, from the identified features, a second feature that has not changed since a pre-specified state associated with the node.
11. The apparatus of claim 9 , wherein while updating the identified features, the updating mechanism is configured to add a second feature based on a policy.
12. The apparatus of claim 9 , further configured to remove a second feature whose occurrence frequency in the network of computing nodes is above a pre-specified threshold.
13. The apparatus of claim 9 , further comprising:
a determining mechanism configured to determine a measure of association between the first feature and a non-malicious process; and
a second communicating mechanism configured to communicate the measure and the first feature to at least one other node in the network.
14. The apparatus of claim 9 , further comprising:
a receiving mechanism configured to receive at a node a measure and a second feature, wherein a sender of the measure and the second feature has determined a measure of association between the second feature and a non-malicious process; and
a controlling mechanism configured to control, based on the measure, one or more of: creating, reading, updating, deleting, and executing the second feature at the node.
15. The apparatus of claim 9 , wherein the first feature is associated with one or more of a file, a machine state, a communication port, a network state, a memory location, and a registry entry.
16. The apparatus of claim 15 , wherein the first feature indicates one or more of:
name or identifier;
creation time;
modification history;
access history;
content;
location;
owner;
creator;
access privilege;
type;
visibility;
security;
data integrity scheme;
suffix;
protection;
usage;
origin;
version;
checksum;
cryptographic checksum;
call graph; and
a change in the features.
17. A computer-readable storage device storing instructions that when executed by a computer cause the computer to perform a method for identifying an undesirable feature in a network of computing nodes, comprising:
detecting an anomaly associated with a node in the network, wherein the anomaly includes an abnormal state or configuration of the node;
identifying one or more features which are associated with the anomaly;
updating the identified features;
sending a comment-soliciting request to at least one other node in the network, wherein the comment-soliciting request specifies the anomaly and the updated features;
receiving, from at least one other node in the network, information indicating whether the at least one other node experienced a correlation between a first feature of the updated features and the anomaly;
correlating the first feature with the anomaly based on the received information; and
producing a result which indicates a correlation between the first feature and the anomaly.
18. The storage device of claim 17 , wherein updating the identified features comprises removing, from the identified features, a second feature that has not changed since a pre-specified state associated with the node.
19. The storage device of claim 17 , wherein updating the identified features comprises adding a second feature based on a policy.
20. The storage device of claim 17 , wherein updating the features further comprises removing a second feature whose occurrence frequency in the network of computing nodes is above a pre-specified threshold.
21. The storage device of claim 17 , further comprising:
determining a measure of association between the first feature and a non-malicious process; and
communicating the measure and the first feature to at least one other node in the network.
22. The storage device of claim 17 , further comprising:
receiving at a node a measure and a second feature, wherein a sender of the measure and the second feature has determined a measure of association between the second feature and a non-malicious process; and
controlling, based on the measure, one or more of: creating, reading, updating, deleting, and executing of the second feature at the node.
23. The storage device of claim 17 , wherein the first feature is associated with one or more of a file, a machine state, a communication port, a network state, a memory location, and a registry entry.
24. The storage device of claim 23 , wherein the first feature is based on one or more of:
name or identifier;
creation time;
modification history;
access history;
content;
location;
owner;
creator;
access privilege;
type;
visibility;
security;
data integrity scheme;
suffix;
protection;
usage;
origin;
version;
checksum;
cryptographic checksum;
call graph; and
a change in the features.