Automatic whitelisting using wildcarding
A computer security system provides for auto-populating process-connection whitelists using process wildcarding and connection wildcarding. Process wildcarding involves grouping process-connection requests together in a process* group without regard to the presence of distinct process arguments; in contrast, some process-connection requests may be separated both by process and by argument into process●argument groups. The process-connection requests may then be analyzed on a group-by-group basis to determine which processes can be mapped to wildcarded connection in a respective process-connection whitelist.
1. A whitelist process comprising:
detecting process-connection requests in which respective processes request respective connections, at least some of the process-connection requests specifying respective arguments;
classifying processes so as to partition them between a wildcarded process process* (wildcarded-process) class and a process●argument class;
grouping, into process●argument groups, process-connection requests by processes of the process●argument class by process and by argument, and grouping, into process* groups, process-connection requests by processes of the process* class by process and not by argument; and
causing a whitelist to include,
based on a first process●argument group of the process●argument groups, a first entry mapping a first process of the process●argument class to a first connection and a first argument,
based on a second process●argument group of the process●argument groups, a second entry mapping the first process of the process●argument class to a second connection and a second argument, the second argument being distinct form the first argument, the second connection being distinct from the first connection, and
based on a process* group of the process* groups, a third entry mapping a process of the process* class to a third connection, at least one of the first connection, the second connection and the third connection being wildcarded.
2. The whitelist process of claim 1 wherein the wildcarded connection includes a wildcarded port or a wildcarded Internet Protocol (IP address).
3. The whitelist process of claim 1 wherein the wildcarded connection in the whitelist is wildcarded based at least in part on a process-connection request for a wildcarded connection.
4. The whitelist process of claim 1 wherein the wildcarded connection in the whitelist is wildcarded based at least in part on a first threshold being met by a first number of distinct connections requested in a respective process* group or process●argument group.
5. The whitelist process of claim 1 wherein the whitelist includes a fourth entry mapping a fourth process to a non-wildcard connection range based at least in part on a second threshold being met by a second number of distinct connections requested in a respective process* group or process●argument group, the second threshold being less than the first threshold.
6. The whitelist process of claim 1 wherein the classifying includes classifying at least one process based on a previous classification of that process as either connection-behavior variant or connection-behavior invariant, and classifying at least one other process based on a number of distinct arguments represented in a group of its requests.
7. A whitelist system comprising non-transitory media encoded with code that, when executed by a processor, implements a whitelist process including:
detecting process-connection requests in which respective processes request respective connections, at least some of the process-connection requests specifying respective arguments;
classifying processes so as to partition them between a wildcarded process process* (wildcarded-process) class and a process●argument class;
grouping, into process●argument groups, process-connection requests by processes of the process●argument class by process and by argument, and grouping, into process* groups, process-connection requests by processes of the process* class by process and not by argument; and
causing a whitelist to include,
based on a first process●argument group of the process●argument groups, a first entry mapping a first process of the process●argument class to a first connection and a first argument,
based on a second process●argument group of the process●argument groups, a second entry mapping the first process of the process●argument class to a second connection and a second argument, the second argument being distinct form the first argument, the second connection being distinct from the first connection, and
based on a process* group of the process* groups, a third entry mapping a process of the process* class to a third connection, at least one of the first connection, the second connection and the third connection being wildcarded.
8. The whitelist system of claim 7 wherein the wildcarded connection includes a wildcarded port or a wildcarded Internet Protocol (IP address).
9. The whitelist system of claim 1 wherein the wildcarded connection in the whitelist is wildcarded based at least in part on a process-connection request for a wildcarded connection.
10. The whitelist system of claim 7 wherein the wildcarded connection in the whitelist is wildcarded based at least in part on a first threshold being met by a first number of distinct connections requested in a respective process* group or process●argument group.
11. The whitelist system of claim 7 wherein the whitelist includes a fourth entry mapping a fourth process to a non-wildcard connection range based at least in part on a second threshold being met by a second number of distinct connections requested in a respective process* group or process●argument group, the second threshold being less than the first threshold.
12. The whitelist process of claim 7 wherein the classifying includes classifying at least one process based on a previous classification of that process as either connection-behavior variant or connection-behavior invariant, and classifying at least one other process based on a number of distinct arguments represented in a group of its requests.
13. The whitelist process of claim 7 further comprising the processor.