System and method for identifying unauthorized activities on a computer system using a data structure model
A computer implemented method includes monitoring activity on the virtual machine. A plurality of activities being performed at the virtual machine is identified. Each of the activities includes an activity source, an activity target, and an association between the activity source and the activity target. The activity information is stored in the memory. The one or more of the activity sources, activity targets, and associations are transmitted to prevent future attacks.
1. A computer implemented method of identifying unauthorized activities on a first computer system attached to a computer network, wherein the first computer system comprises one or more processors and memory, the method comprising:
monitoring activity on the first computer system;
identifying a plurality of activities being performed at the first computer system, wherein each of the activities includes an activity source, an activity target, and an association between the activity source and the activity target;
storing in the memory a data structure that identifies the activity sources, the activity targets, and the associations for the plurality of activities; and
transmitting to one or more computer systems other than the first computer system information identifying one or more of the activity sources, the activity targets, and the associations for preventing future attacks, to the one or more computer systems, associated with the one or more of the activity sources, the activity targets, and the associations.
2. The method of claim 1 , wherein the monitoring further comprises monitoring all activity on the first computer system.
3. The method of claim 1 , further comprising:
creating, from the stored information, a fingerprint indicative of the activity on the first computer system.
4. The method of claim 1 , wherein the activities comprise two or more of: a file initiating an execution of an instruction, an instruction reading a file, an instruction writing to a file, and receiving data through the network.
5. The method of claim 1 , wherein a respective activity target comprises one of: a file, a user, an instruction, a thread, data stream, and network socket connections.
6. The method of claim 1 , wherein a respective activity source comprises one of: a file, a user, an instruction, a thread, data stream, and network socket connections.
7. The method of claim 1 , further comprising:
graphically displaying at least a subset of the stored activities.
8. The method of claim 7 , wherein the displaying includes visually distinguishing at least a subset of the associations.
9. The method of claim 1 , wherein an activity target of a first activity of the plurality of activities is an activity source of a second activity of the plurality of activities.
10. The method of claim 1 , further comprising:
identifying a respective association between a first activity source and a first activity target as unauthorized, wherein the first activity target, when associated as a second activity source with a second activity target, causes unauthorized activities on the second activity target.
11. The method of claim 10 , further comprising:
tracking a transfer of malicious associations over time.
12. The method of claim 1 , further comprising:
identifying activity sources that are affected by unauthorized activities.
13. The method of claim 12 , wherein the identifying activity sources that are affected by unauthorized activities includes identifying activity sources that request to access a portion of memory that is set as non-executable.
14. The method of claim 12 , wherein:
instructions executed by the one or more processors have respective privilege levels;
respective activity sources have respective privilege levels; and
the identifying activity sources that are affected by unauthorized activities includes identifying activity sources that request to execute underprivileged instructions.
15. The method of claim 12 , wherein the identifying activity sources that are affected by unauthorized activities includes identifying data stream incoming from outside the first computer system.
16. The method of claim 1 , further comprising:
determining an activity status for the stored events, the activity status comprising one of:
a complete status, representing that a source of unauthorized activities is identified, and each activity target in the stored activities is associated with the source through one or more associations; and
an incomplete status, which represents that the source of unauthorized activities is not identified, or at least one activity target in the stored activities is not associated with the source through one or more associations.
17. The method of claim 1 , further comprising:
determining an activity level representing a frequency of unauthorized activities on the first computer system during a predefined time interval.
18. The method of claim 1 , further comprising:
identifying a respective activity as unauthorized based on a determination that the respective activity is associated with an unauthorized activity that is distinct from the respective activity.
19. The method of claim 1 , wherein the association includes a type that represents whether or not the activity source has modified the activity target to perform the unauthorized activities.
20. A first computer system, comprising:
one or more processors; and
memory storing one or more programs, the one or more programs including instructions for:
monitoring activity on the first computer system;
identifying a plurality of activities being performed at the first computer system, where each of the activities includes an activity source, an activity target, and an association between the activity source and the activity target;
storing in the memory a data structure that identifies the activity sources, the activity targets, and the associations for the plurality of activities; and
transmitting to one or more computer systems other than the first computer system information identifying one or more of the activity sources, the activity targets, and the associations for preventing future attacks, to the one or more computer systems, associated with the one or more of the activity sources, the activity targets, and the associations.
21. A computer readable storage medium, including one or more programs for execution by one or more processors of a first computer system, the one or more programs including instructions for:
monitoring activity on the first computer system;
identifying a plurality of activities being performed at the first computer system, where each of the activities includes an activity source, an activity target, and an association between the activity source and the activity target;
storing in memory of the first computer system a data structure that identifies the activity sources, the activity targets, and the associations for the plurality of activities; and
transmitting to one or more computer systems other than the first computer system information identifying one or more of the activity sources, activity targets, and associations for preventing future attacks, to the one or more computer systems, associated with the one or more of the activity sources, the activity targets, and the associations.