State-based entity behavior analysis
Examples of the present disclosure describe systems and methods for state-based entity behavior analysis. In an example, entities of a computing environment may be represented using a hierarchical entity web. In some examples, an entity may have a state associated with it, which may be modeled using a place/transition (PT) network. Events within the computing environment may be evaluated by transitions of a PT network to determine whether an entity should change state. If an entity transitions from one state to another, one or more actions may be performed, including, but not limited to, taking a remedial action, generating a recommendation, and updating the state of one or more associated entities. Thus, aspects disclosed herein may provide a high-level overview of the state of entities of a computing environment, but may also be used to view in-depth information of entities at lower levels of the hierarchical entity web.
1. A method for state-based entity analysis in a computing environment, comprising:
receiving an indication of a state change for an entity having an entity state, the indication of the state change for the entity based on:
receiving of an event associated with the entity;
determining that the event represents a state change transition of the entity, the state change transition associated with a place/transition (PT) network for the entity, the PT network comprising a plurality of entity states and state change transitions between the plurality of entity states, said determining comprising:
identifying the state change transition of the entity; and
determining that the event represents the state change transition of the entity by executing computer code corresponding to the state change transition of the entity;
generating the state change for the entity, comprising modifying the entity state of the entity; and
performing a remedial action on the entity based on the state change transition of the entity.
2. The method of claim 1 , wherein the indication of the state change for the entity is received as a result of a state change transition for the PT network of an entity web of a plurality of entities.
3. The method of claim 1 , wherein the entity states comprise a good state, an unknown state, and a bad state.
4. The method of claim 3 , wherein the remedial action is performed if the state change transition of the entity represents a transition from the good state of the entity to the bad state of the entity, the good state of the entity to the unknown state of the entity, or the unknown state of the entity to the bad state of the entity.
5. The method of claim 1 , wherein the remedial action comprises restoring the entity state to a backup of the entity state or performing a malware scan of the entity.
6. The method of claim 1 , wherein the state change transition comprises a predefined transition stored in association with the PT network, a user-defined transition, or a dynamically generated transition.
7. The method of claim 1 , wherein performing the remedial action on the entity based on the state change transition comprises receiving input for a recommendation for the remedial action to improve the entity state.
8. A system for state-based entity analysis in a computing environment, comprising:
a processor;
memory coupled to the processor, the memory comprising computer executable instructions that, when executed by the processor, perform a method of state-based entity analysis in a computing environment; comprising:
receiving an indication of a state change for an entity having an entity state, the indication of the state change for the entity based on:
receiving of an event associated with the entity;
determining that the event represents a state change transition of the entity, the state change transition associated with a place/transition (PT) network for the entity, the PT network comprising a plurality of entity states and state change transitions between the plurality of entity states, said determining comprising:
identifying the state change transition of the entity; and
determining that the event represents the state change transition of the entity by executing computer code corresponding to the state change transition of the entity;
generating the state change for the entity, comprising modifying the entity state of the entity; and
performing a remedial action on the entity based on the state change transition.
9. The system of claim 8 , wherein the indication of the state change for the entity is received as a result of a state change transition for the PT network of an entity web of a plurality of entities.
10. The system of claim 8 , wherein the entity states comprise a good state, an unknown state, and a bad state.
11. The system of claim 10 , wherein the remedial action is performed if the state change transition of the entity represents a transition from the good state of the entity to the bad state of the entity, the good state of the entity to the unknown state of the entity, or the unknown state of the entity to the bad state of the entity.
12. The system of claim 8 , wherein the remedial action comprises restoring the entity state to a backup of the entity state or performing a malware scan of the entity.
13. The system of claim 8 , wherein the state change transition comprises a predefined transition stored in association with the PT network, a user-defined transition, or a dynamically generated transition.
14. The system of claim 8 , wherein performing the remedial action on the entity based on the state change transition comprises receiving input for a recommendation for the remedial action to improve the entity state.
15. A computer program product comprising a non-transitory computer readable medium storing instructions executable by a processor to perform a set of operations for state-based entity analysis in a computing environment, the set of operations comprising:
receiving an indication of a state change for an entity having an entity state, the indication of the state change for the entity based on:
receiving of an event associated with the entity;
determining that the event represents a state change transition of the entity, the state change transition associated with a place/transition (PT) network for the entity, the PT network comprising a plurality of entity states and state change transitions between the plurality of entity states, said determining comprising:
identifying the state change transition of the entity; and
determining that the event represents the state change transition of the entity by executing computer code corresponding to the state change transition of the entity;
generating the state change for the entity, comprising modifying the entity state of the entity; and
performing a remedial action on the entity based on the state change transition.
16. The computer program product of claim 15 , wherein the indication of the state change for the entity is received as a result of a state change transition for the PT network of an entity web of a plurality of entities.
17. The computer program product of claim 15 , wherein the entity states comprise a good state, an unknown state, and a bad state.
18. The computer program product of claim 17 , wherein the remedial action is performed if the state change transition of the entity represents a transition from the good state of the entity to the bad state of the entity, the good state of the entity to the unknown state of the entity, or the unknown state of the entity to the bad state of the entity.
19. The computer program product of claim 15 , wherein the state change transition comprises a predefined transition stored in association with the PT network, a user-defined transition, or a dynamically generated transition.
20. The computer program product of claim 15 , wherein performing the remedial action on the entity based on the state change transition comprises receiving input for a recommendation for the remedial action to improve the entity state.