Security in a computing environment by monitoring expected operation of processes within the computing environment
A process monitoring methodology is disclosed. In a computer-implemented method, a selection of a process to be monitored is received. The process is to be at least partially performed using a component of a computing environment. An expected operating parameter of the process is determined. The process is also monitored to determine an actual operating parameter of the process. The actual operating parameter of the process is compared with the expected operating parameter of the process to generate a comparison result. An operation is then automatically performed based upon the comparison result.
1. A computer-implemented method for automated monitoring of a plurality of whitelisted processes operating in a computing environment, said method comprising:
generating a listing of processes including said plurality of whitelisted processes, each said plurality of whitelisted processes to be at least partially performed using components of said computing environment;
automatically monitoring each of said plurality of whitelisted processes for a period of time to determine a baseline for a respective expected operating parameter for each of said plurality of whitelisted processes;
automatically monitoring each of said plurality of whitelisted processes during operation of each of said plurality of whitelisted processes to determine a respective actual operating parameter for each of said plurality of whitelisted processes;
comparing each of said respective actual operating parameter for each of said plurality of whitelisted processes with a corresponding each of said respective expected operating parameter for each of said plurality of whitelisted processes said process to generate respective comparison results; and
automatically performing an operation based upon at least one of said respective comparison results.
2. The computer-implemented method of claim 1 wherein said determining a baseline for said respective expected performance parameter of each of said plurality of whitelisted processes further comprises:
monitoring each of said plurality of whitelisted processes for a period of time to establish a respective history of performance for each of said plurality of whitelisted processes; and
utilizing said respective history of performance for each of said plurality of whitelisted processes to generate said respective expected performance parameter of each of said plurality of whitelisted processes.
3. The computer-implemented method of claim 1 wherein said determining a baseline for said respective expected performance parameter of each of said plurality of whitelisted processes further comprises:
monitoring each of said plurality of whitelisted processes for a period of time to establish a respective history of performance for each of said plurality of whitelisted processes; and
generating a first boundary for each of said respective history of performance for each of said plurality of whitelisted processes.
4. The computer-implemented method of claim 1 wherein said determining a baseline for said respective expected performance parameter of each of said plurality of whitelisted processes further comprises:
monitoring each of said plurality of whitelisted processes for a period of time to establish a respective history of performance for each of said plurality of whitelisted processes;
generating an upper boundary for each of said respective history of performance for each of said plurality of whitelisted processes; and
generating a lower boundary for each of said respective history of performance for each of said plurality of whitelisted processes.
5. The computer-implemented method of claim 1 wherein said automatically performing an operation based upon at least one of said respective comparison results further comprises:
generating an alarm indicating that at least one of said respective actual operating parameter differs from a corresponding said respective expected operating parameter.
6. The computer-implemented method of claim 1 wherein said automatically performing an operation based upon at least one of said respective comparison results further comprises:
ceasing operation of at least one of said plurality of whitelisted processes when said at least one of said plurality of whitelisted processes has an actual operating parameter which differs from a corresponding expected operating parameter.
7. A computer-implemented method for automated monitoring of a process in a computing environment, said method comprising:
receiving a selection of a process to be monitored, said process be at least partially performed using a component of said computing environment;
determining an expected operating parameter of said process;
monitoring said process to determine an actual operating parameter of said process;
comparing said actual operating parameter of said process with said expected operating parameter of said process to generate a comparison result; and
automatically performing an operation based upon said comparison result.
8. The computer-implemented method of claim 7 wherein said receiving a selection of a process to be monitored further comprises:
receiving a selection of a whitelisted process to be monitored.
9. The computer-implemented method of claim 7 wherein said receiving a selection of a process to be monitored further comprises:
receiving a listing of a plurality of whitelisted processes and wherein at least one of said plurality of whitelisted processes is to be monitored.
10. The computer-implemented method of claim 9 wherein said receiving a selection of a process to be monitored further comprises:
receiving a listing of processes including a plurality of whitelisted processes, said plurality of whitelisted processes to be at least partially performed using components of said computing environment.
11. The computer-implemented method of claim 7 wherein said determining an expected performance parameter of said process further comprises:
monitoring said process for a period of time to establish a history of performance of said process; and
utilizing said history of performance of said process to generate said expected performance parameter of said process.
12. A computer-implemented method for automated monitoring of a plurality of whitelisted processes operating in a computing environment, said method comprising:
receiving a listing of processes including said plurality of whitelisted processes, each said plurality of whitelisted processes to be at least partially performed using components of said computing environment;
determining a respective expected operating parameter for each of said plurality of whitelisted processes;
monitoring each of said plurality of whitelisted processes to determine a respective actual operating parameter for each of said plurality of whitelisted processes;
comparing each of said respective actual operating parameter for each of said plurality of whitelisted processes with a corresponding each of said respective expected operating parameter for each of said plurality of whitelisted processes said process to generate respective comparison results; and
automatically performing an operation based upon at least one of said respective comparison results.
13. The computer-implemented method of claim 12 wherein said determining a baseline for said respective expected performance parameter of each of said plurality of whitelisted processes further comprises:
monitoring each of said plurality of whitelisted processes for a period of time to establish a respective history of performance for each of said plurality of whitelisted processes; and
utilizing said respective history of performance for each of said plurality of whitelisted processes to generate said respective expected performance parameter of each of said plurality of whitelisted processes.
14. The computer-implemented method of claim 12 wherein said determining a baseline for said respective expected performance parameter of each of said plurality of whitelisted processes further comprises:
monitoring each of said plurality of whitelisted processes for a period of time to establish a respective history of performance for each of said plurality of whitelisted processes; and
generating a first boundary for each of said respective history of performance for each of said plurality of whitelisted processes.
15. The computer-implemented method of claim 12 wherein said determining a baseline for said respective expected performance parameter of each of said plurality of whitelisted processes further comprises:
monitoring each of said plurality of whitelisted processes for a period of time to establish a respective history of performance for each of said plurality of whitelisted processes;
generating an upper boundary for each of said respective history of performance for each of said plurality of whitelisted processes; and
generating a lower boundary for each of said respective history of performance for each of said plurality of whitelisted processes.
16. The computer-implemented method of claim 12 wherein said automatically performing an operation based upon at least one of said respective comparison results further comprises:
generating an alarm indicating that at least one of said respective actual operating parameter differs from a corresponding said respective expected operating parameter.
17. The computer-implemented method of claim 12 wherein said automatically performing an operation based upon at least one of said respective comparison results further comprises:
ceasing operation of at least one of said plurality of whitelisted processes when said at least one of said plurality of whitelisted processes has an actual operating parameter which differs from a corresponding expected operating parameter.