System and method for providing security in a distributed computation system utilizing containers
A server has a processor and a memory connected to the processor. The memory stores instructions executed by the processor to collect operating signals from machines, where each operating signal characterizes the state or a change in operational state of a designated application operating within a designated container, where the designated container is an isolated process in user space designated by an operating system kernel. The operating signals are compared to models that incorporate summarizations of data sets that represent observed benign operating signals and malicious operating signals for the designated application operating within the designated container. Risks associated with the operating signals are characterized.
1. A server, comprising:
a processor; and
a memory connected to the processor, the memory storing instructions executed by the processor to:
collect operating signals from machines, wherein each operating signal characterizes the state or a change in operational state of a designated application operating within a designated container, wherein the designated container is an isolated process in user space designated by an operating system kernel, wherein the operational state includes characterization of system calls, function calls, network input and output, file reads and file writes for the designated application,
compare the operating signals to models that incorporate summarizations of data sets that represent observed benign operating signals and malicious operating signals for the designated application operating within the designated container, and
characterize risks associated with the operating signals.
2. The server of claim 1 wherein each operating signal includes container event and command signals for the designated container.
3. The server of claim 1 further comprising instructions executed by the processor to form a fingerprint for the designated container based upon behavior of the designated container.
4. The server of claim 3 wherein the behavior includes runtime attributes of the designated container.
5. The server of claim 3 further comprising instructions executed by the processor to combine behaviors from multiple containers to produce an application fingerprint.
6. The server of claim 5 further comprising instructions executed by the processor to combine behaviors from multiple application fingerprints to characterize a system.
7. The server of claim 1 further comprising instructions executed by the processor to form a fingerprint for the designated container based upon static attributes of the designated container.
8. The server of claim 1 wherein the models include a discriminative model that classifies operating signals into either benign operating signals or malicious operating signals for the designated application.
9. The server of claim 1 wherein the models include a generative model that is a predictive model of next application state given a sequence of past application states for the designated application.
10. The server of claim 1 wherein the models include a generative model that is a predictive model of all observations in at least one benign category for the designated application.
11. The server of claim 1 wherein the models include a generative model that is a predictive model of all observations in at least one malicious category for the designated application.
12. The server of claim 1 wherein the models include a generative model that is a predictive model of all observations in multiple categories for the designated application.
13. The server of claim 1 wherein the models include a set model for a benign category including a list of benign indicators.
14. The server of claim 1 wherein the models include a set model for a malicious category including a list of malicious indicators.
15. The server of claim 1 wherein outputs from the comparison of the operating signals to the models are assigned different weights and are combined to generate a single classification.
16. The server of claim 15 wherein the single classification has an associated confidence measure.
17. The server of claim 15 wherein the single classification has an associated uniqueness measure.
18. The server of claim 1 further comprising instructions executed by the processor to enforce a security measure in response to operating signals that exceed a risk threshold.
19. The server of claim 1 further comprising instructions executed by the processor to supply security analytics.
20. The server of claim 1 further comprising instructions executed by the processor to supply a measure of machine learning model efficacy.
21. The server of claim 1 further comprising instructions executed by the processor to prepare a report that combines the risks associated with the operating signals with information technology system characteristics for the designated application.
22. The server of claim 1 further comprising instructions executed by the processor to supply a measure of confidence in the integrity of the designated application.
23. The server of claim 1 further comprising instructions executed by the processor to supply a measure of confidence in the integrity of the designated container.
24. The server of claim 1 wherein the instructions executed by the processor to collect, compare and characterize are implemented in a security platform container.
25. The server of claim 24 further comprising instructions executed by the processor supply a measure of confidence in the integrity of the security platform container.
26. The server of claim 1 further comprising instructions executed by the processor to analyze anomalous operating signals to characterize the likelihood of an application transition from a benign state to a malicious state.
27. The server of claim 1 wherein the models adapt to changes in benign or malicious application behavior during an operational phase.
28. The server of claim 1 further comprising instructions executed by the processor to analyze relationships between operating signals, security events, or security policies.
29. The server of claim 1 further comprising instructions executed by the processor to analyze operating signals, security events, or security policies to recommend security policies or security measures.