Supply chain attack detection
Methods, storage systems and computer program products implement embodiments of the present invention that include identifying multiple host computers executing respective instances of a specific software application, each given instance on each given host computer including a set of program instructions loaded, by the host computer, from a respective storage device. Information on actions performed by the executing instances is collected from the host computers, and features are computed based on the information collected from the multiple host computers. The collected information for a given instance are compared to the features so as to classify the given instance as benign or suspicious, and an alert s generated for the given instance only upon classifying the given instance as suspicious.
1. A method, comprising:
identifying multiple host computers executing respective instances of a specific software application, each given instance on each given host computer comprising a set of program instructions loaded, by the host computer, from a respective storage device;
collecting, from the host computers, information on actions performed by the executing instances, the information comprising action types and entities;
computing features based on the information collected from the multiple host computers;
comparing, by a processor, the collected information for a given instance to the features so as to classify the given instance as benign or suspicious; and
generating an alert for the given instance only upon classifying the given instance as suspicious,
wherein the host computers comprise first host computers that are distributed among a plurality of sources, and wherein a set of host computers distributed among the sources comprises the first host computers and additional host computers, and
further comprising normalizing the entities into normalized entities, and defining, for each one of the actions, a corresponding normalized action comprising the respective action type and normalized entity for the one of the actions.
2. The method according to claim 1 , wherein the action type for a given action comprises creating or injecting a process, and wherein the entity for the given action comprises a process having a process name.
3. The method according to claim 1 , wherein the action type for a given action comprises accessing a domain, and wherein the entity for the given action comprises a domain name.
4. The method according to claim 1 , wherein the action type for a given action comprises accessing an Internet Protocol (IP) address, and wherein the entity for the given action comprises an IP address.
5. The method according to claim 1 , wherein the action type for a given action comprises accessing an autonomous system number (ASN) address, and wherein the entity for the given action comprises an ASN.
6. The method according to claim 1 , wherein the action type for a given action comprises loading a shared library, and wherein the entity for the given action comprises a shared library having respective name.
7. The method according to claim 1 , wherein the action type for a given action comprises accessing a file, and wherein the entity for the given action comprises a file having a file name.
8. The method according to claim 1 , wherein the action type for a given action comprises accessing a key in a registry, and wherein the entity for the given action comprises a registry key having a key name.
9. The method according to claim 1 , wherein the action type for a given action comprises convey a system call to an operating system, and wherein the entity for the given action comprises a system call having a system call name.
10. The method according to claim 1 , wherein computing given feature comprises computing a count of the sources.
11. The method according to claim 1 , wherein computing given feature comprises computing a count of the sources comprising at least one host computer in the set executing a given instance of the software application.
12. The method according to claim 1 , wherein for each given action type, computing a given feature comprises computing a count of the host computers in the set executing a given instance of the software application that performed a given action comprising the given action type.
13. The method according to claim 1 , wherein for each given action type, computing a given feature comprises computing a count of the sources comprising at least one host computer in the set that performed a given action comprising the given action type.
14. The method according to claim 1 , wherein for each given normalized action, computing a given feature comprises computing a count of the sources comprising at least one host computer in the set that performed the given normalized action.
15. The method according to claim 1 , wherein computing a given feature comprises computing a count of distinct normalized actions.
16. The method according to claim 1 , wherein for a given source, computing a given feature comprises computing a first count of distinct normalized actions performed by instances of the software application executing on the host computers at the given source, computing respective second counts of distinct normalized actions performed by instances of the software application executing on the host computers at each of the sources other than the given source, computing an average of the second counts, and comparing the first count to the computed average.
17. The method according to claim 1 , wherein for each given action type, computing a given feature comprises computing a count of the sources having at least one host computer in the set executing a given instance of the software application that performed a given action comprising the given action type.
18. The method according to claim 1 , wherein for each given normalized action, computing a given feature comprises computing a count of the sources having at least one host computer in the set executing a given instance of the software application that performed the given normalized action.
19. The method according to claim 1 , wherein for each given normalized action, computing a given feature comprises computing a count of the host computers in the set executing a given instance of the software application that performed the given normalized action.
20. The method according to claim 1 , wherein for each given source, computing a given feature comprises computing a count of the host computers in the set executing a given instance of the software application.
21. The method according to claim 1 , wherein for each combination comprising a given source and a given normalized action, computing a given feature comprises computing a count of the host computers in in the given source that performed the given normalized action.
22. The method according to claim 1 , wherein for each combination comprising a given source and a given action type, computing a given feature comprises computing a count of the host computers in in the given source that performed a given normalized action comprising the given action type.
23. The method according to claim 1 , wherein for each source, computing a given feature comprises computing a count of different normalized actions performed by the software application executing on the host computers belonging to the given source.
24. The method according to claim 1 , wherein for each source, computing a given feature comprises computing a count of the host computers belonging to the given source.
25. The method according to claim 1 , wherein the host computers execute multiple software applications having respective names, and further comprising normalizing the names, wherein the instances of the specific software application comprising the instances of the software application having identical normalized names.
26. The method according to claim 1 , wherein collecting the information for a given action performed by a given instance on a given host computer comprises detecting, by an endpoint agent executing on the host computer, the given action performed by the given instance, extracting, by the endpoint agent, the information for the given action, conveying by the endpoint agent the extracted information, and receiving, by the processor, the conveyed information.
27. An apparatus, comprising:
a network interface controller (NIC); and
one or more hardware processors configured:
to identify multiple host computers executing respective instances of a specific software application, each given instance on each given host computer comprising a set of program instructions loaded, by the host computer, from a respective storage device,
to collect, from the host computers via the NIC, information on actions performed by the executing instances, the information comprising action types and entities,
to compute features based on the information collected from the multiple host computers,
to compare the collected information for a given instance to the features so as to classify the given instance as benign or suspicious, and
to generate an alert for the given instance only upon classifying the given instance as suspicious,
wherein the host computers comprise first host computers that are distributed among a plurality of sources, and wherein a set of host computers distributed among the sources comprises the first host computers and additional host computers, and
wherein the one or more hardware processors are further configured to normalize the entities into normalized entities, and to define, for each one of the actions, a corresponding normalized action comprising the respective action type and normalized entity for the one of the actions.
28. A computer software product, the product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:
to identify multiple host computers executing respective instances of a specific software application, each given instance on each given host computer comprising a set of program instructions loaded, by the host computer, from a respective storage device;
to collect, from the host computers, information on actions performed by the executing instances, the information comprising action types and entities;
to compute features based on the information collected from the multiple host computers;
to compare the collected information for a given instance to the features so as to classify the given instance as benign or suspicious; and
to generate an alert for the given instance only upon classifying the given instance as suspicious,
wherein the host computers comprise first host computers that are distributed among a plurality of sources, and wherein a set of host computers distributed among the sources comprises the first host computers and additional host computers, and
wherein the instructions cause the computer to normalize the entities into normalized entities, and to define, for each one of the actions, a corresponding normalized action comprising the respective action type and normalized entity for the one of the actions.