Baseline calculation for firewalling
A method, computer program product, and apparatus for performing baseline calculations for firewalling in a computer network is disclosed. The method involves defining a reference group for an executed software program, measuring signals in the reference group, measuring signals of the program, computing a distance between the signals of the program and the signals of the reference group, and taking an action if the computed distance deviates from a norm mode. The distance can be computed using a similarity matrix or other method. Measuring the program comprises observing behaviors of the program, collecting and analyzing data, comparing the data to baselines of the reference group, and comparing the behaviors of the program across a previous execution of the program. In cases where a program is known to be malicious, a reference group is not needed and a sandbox can be tailored just by copying the environment of the actual system.
1. A method for tailoring the operations of a sandbox on a computer or in a network of computers, comprising the steps of:
collecting baseline data including which versions of programs are running on the computer or on different computers in the network of computers;
defining a reference group, the reference group being a collection of software programs identified by the baseline data, wherein the reference group identifies a set of programs that have similar names, locations, dates of installation or dates of running;
collecting a first set of nonsandbox signals from execution of software programs identified within the reference group by executing programs from the collection of software programs that form the reference group, the first set of nonsandbox signals including at least one of: system calls, file operations, network activity, inter-process communication, electronic toll collection, input and output operations, or computation time;
sandboxing the reference group to represent an expected operating environment where programs identified in the reference group will run, the expected operating environment derived from the baseline data;
executing the programs identified in the reference group in the sandbox and collecting a second set of sandbox signals from the sandbox representing execution of said programs identified in the reference group in the expected operating environment;
computing a distance between the second set of sandbox signals from the sandbox and the first set of nonsandbox signals from the reference group; and taking an action if the distance is greater than a predetermined threshold.
2. The method of claim 1 , wherein the collecting steps comprise:
observing behavior of a program, including memory requests, service calls, input-output requests, or network access;
comparing the behavior of the program with those of a previous execution of the program, or with cross executions of other programs in the reference group.
3. The method of claim 1 , wherein the distance is computed using a similarity matrix.
4. The method of claim 1 , wherein the first and second set of signals are collected and analyzed in a distributed peer-to-peer network or on a centralized server.
5. The method of claim 1 , further comprising the steps of:
benchmarking a spread of changes within a network as compared to the spread of contagion within other networks; and
generating a warning if the spread of changes within a network is faster than the spread of contagion within other networks.
6. The method of claim 1 , wherein system knowledge is used to create a dynamic firewall in which rules for allowing or disallowing network activity depends on the activity of other machines in the network.
7. The method of claim 1 , wherein collecting a large amount of data is performed by saving a subset of the data, saving hashes of the data, or creating and saving one or more functions of the data.
8. The method of claim 1 , wherein taking an action is prohibiting an activity.
9. A non-transitory computer program product for tailoring the operations of a sandbox on a computer, comprising: a non-transitory computer readable medium;
a first program instruction for defining a reference group, the reference group being a collection of software programs similar to one another according to a characteristic;
a second program instruction for collecting a first set of nonsandbox signals of the reference group by executing programs from the collection of software programs that form the reference group;
a third program instruction for sandboxing to represent an expected operating environment where the programs of the reference group will run;
a fourth program instruction for executing the programs of the reference group in the sandbox and collecting a second set of sandbox signals from the sandbox representing execution in the expected operating environment;
a fifth program instruction for computing a distance between the second set of sandbox signals from the sandbox and the characteristic signals for the reference group; and
a sixth program instruction for taking an action if the distance is greater than a predetermined threshold;
wherein said first, second, third, fourth, fifth and sixth, program instructions are stored on said non-transitory computer readable medium.
10. The non-transitory computer program product of claim 9 , wherein the collecting program instruction comprises the steps of
observing behavior of a program, including memory requests, service calls, input-output requests, and network access;
comparing the behavior of the program with those of a previous execution of the program, or with cross executions of other programs in the reference group.
11. The non-transitory computer program product of claim 9 , wherein the distance is computed using a similarity matrix.
12. The non-transitory computer program product of claim 9 , wherein the first and second set of signals are collected and analyzed in a distributed peer-to-peer network or on a centralized server.
13. The non-transitory computer program product of claim 9 , wherein the reference group characteristic is one or more of similar names, locations, dates of installation or dates of running.
14. The non-transitory computer program product of claim 9 , further comprising computer instructions for:
benchmarking a spread of changes within a network as compared to the spread of contagion within other networks; and
generating a warning if the spread of changes within a network is faster than the spread of contagion within other networks.
15. The non-transitory computer program product of claim 9 , wherein system knowledge is used to create a dynamic firewall in which rules for allowing or disallowing network activity depends on the activity of other machines in the network.
16. The non-transitory computer program product of claim 9 , wherein collecting a large amount of data is performed by saving a subset of the data, saving hashes of the data, or creating and saving a function of the data.
17. The non-transitory computer program product of claim 9 , wherein taking an action is prohibiting an activity.
18. An apparatus having a processing unit and a storage device, the apparatus comprising:
a defining component for defining a reference group, the reference group being a collection of software programs similar to one another according to a characteristic;
a collecting component for collecting a first set of nonsandbox signals of the reference group by executing programs from the collection of software programs that form the reference group;
a sandboxing component for generating a sandbox to represent an expected operating environment where the programs identified by the reference group will run;
an executing component for executing programs in the sandbox and collecting a second set of sandbox signals from the sandbox representing execution of the target program in the expected operating environment;
a computing component for computing a distance between the second set of sandbox signals from the sandbox and the first set of nonsandbox signals from the reference group; and
an action component for taking an action if the distance is greater than a predetermined threshold.
19. The apparatus of claim 18 , wherein the number and type of files in the sandbox are similar to the number and type of files in the real environment.
20. The apparatus of claim 18 , wherein the types and versions of programs in the sandbox are similar to the types and versions of programs in the real environment.
21. The apparatus of claim 18 , further comprising tailoring operations of the sandbox by:
copying a real system environment in which a target program runs into the sandbox:
measuring signals from the target program in the sandbox and
adjusting the sandbox based on said measuring, wherein the tailored sandbox results in longer running of programs in the sandbox as well as fewer false positives.
22. The apparatus of claim 18 , wherein the sandbox is an actual copy of a production machine.