RESILIENT MANAGEMENT OF RESOURCE UTILIZATION
Embodiments of the invention deploy a hierarchical lattice of intelligent sensor/controller/actuator software components at managed endpoint devices and/or in network gateways. That is, each such device runs at least one sensor, at least one actuator, and, unless it is deployed remotely, the intelligent controller. Sensors monitor and analyze computational activity to detect potential anomalous behavior. The intelligent controller receives data from the sensors and analyzes these, generally on successive time windows of sensor data, by comparison against a model for acceptable or unacceptable resource use or behavior. Application code may be modified so that operating system calls are redirected to a sensor module, which may perform an initial evaluation (or have that evaluation performed by a separate controller module, which may or may not reside on the same device) that grants or denies permission for the call depending on a perceived threat level, and also accumulates these calls over time to develop a detailed map of all the resources an application uses and how they may be characterized.
1 . A computational system comprising:
a. a processor;
b. an operating system;
c. a computer memory;
d. a plurality of user applications;
e. a plurality of sensors for monitoring calls by the user applications to the operating system; and
f. an intelligent controller, wherein:
i. each of the applications is configured to redirect operating-system calls to an intercept handler of one of the sensors,
ii. the sensors are configured to submit, to the intelligent controller, each operating-system call received by an intercept handler,
iii. the controller implements a predictive response model to detect anomalous behavior, and based on an analysis of the operating-system call by the predictive response model, allows or disallows the operating-system call, and further wherein the analysis by the predictive response model is responsive to operating-system calls previously made by other applications.
2 . The system of claim 1 , wherein the controller is locally executed with the user applications and the sensors by the processor.
3 . The system of claim 1 , wherein the controller is remote and is configured to communicate with the processor via a network.
4 . The system of claim 1 , wherein the controller is further configured to construct and store, in the computer memory, a statistical resource utilization model for all applications hosted by the system based on the received operating-system calls.
5 . The system of claim 4 , wherein the predictive response model is responsive to operating-system calls previously made by other applications via the statistical resource utilization model.
6 . The system of claim 1 , wherein the predictive response model of the intelligent controller is a machine-learning model.
7 . The system of claim 6 , wherein the machine-learning model includes a supervised learning algorithm.
8 . The system of claim 6 , wherein the machine-learning model includes an unsupervised learning algorithm.
9 . The system of claim 1 , wherein the predictive response model is user-specific.
10 . The system of claim 1 , wherein the sensors each include a classifier for assessing a risk associated with the monitored calls to the operating system.
11 . The system of claim 1 , wherein the classifier is a Bayes classifier.
12 . A computational method comprising the steps of:
at a plurality of endpoint devices, executing, by a processor, a plurality of user applications and executing a sensor associated with each of the applications, each of the applications being configured to redirect operating-system calls to an intercept handler of the associated sensor;
submitting, by the sensors, each operating-system call received by an intercept handler to an intelligent controller;
analyzing, by the intelligent controller, each of the submitted operating-system calls in accordance with a predictive response model to detect anomalous behavior, and based thereon, allowing or disallowing the operating-system call, wherein the predictive response model is responsive to operating-system calls previously made by other applications.
13 . The method of claim 12 , wherein the controller is locally executed with the user applications and the sensors by the processor.
14 . The method of claim 12 , wherein the controller is remote and is configured to communicate with the processor via a network.
15 . The method of claim 12 , further comprising constructing and storing, by the controller, a statistical resource utilization model for all applications executable by each of the endpoint devices.
16 . The method of claim 15 , wherein the predictive response model is responsive to operating-system calls previously made by other applications via the statistical resource utilization model.
17 . The method of claim 12 , wherein the predictive response model of the intelligent controller is a machine-learning model.
18 . The method of claim 17 , wherein the machine-learning model includes a supervised learning algorithm.
19 . The method of claim 17 , wherein the machine-learning model includes an unsupervised learning algorithm.
20 . The method of claim 12 , wherein the predictive response model is user-specific.
21 . The method of claim 12 , wherein the sensors each include a classifier for assessing a risk associated with the monitored calls to the operating system.
22 . The method of claim 12 , wherein the classifier is a Bayes classifier.