Discovering and constraining idle processes
Methods and systems for process constraint include collecting system call information for a process. It is detected whether the process is idle based on the system call information and then whether the process is repeating using autocorrelation to determine whether the process issues system calls in a periodic fashion. The process is constrained if it is idle or repeating to limit an attack surface presented by the process.
1. A method for process constraint, comprising:
collecting system call information for a process;
detecting whether the process is idle based on the system call information;
detecting whether the process is repeating using autocorrelation to determine whether the process issues system calls in a periodic fashion; and
constraining the process if it is idle or repeating to limit an attack surface presented by the process;
wherein detecting whether the process is repeating comprises removing time stamp information from the system call information;
wherein detecting whether the process is repeating further comprises performing a time check by shifting an original sequence to match a correlated sequence and comparing an average difference between timestamps of corresponding pairs; and
wherein detecting whether the process is repeating comprises comparing the average difference to a threshold to determine whether the correlated sequence is true.
2. The method of claim 1 , wherein collecting system call information comprises collecting a limited subset of system call information that does not include call stacks.
3. The method of claim 1 , wherein detecting whether the process is idle further comprises monitoring processor activity.
4. The method of claim 1 , wherein constraining the process comprises learning a normal behavior of the process and identifying system calls that fall outside the normal behavior.