Granted Patent B1

US 12,615,271 · App. 18/201,939 · Granted Apr 28, 2026

Inventors: Ulfar Erlingsson (Palo Alto, CA); Yijou Chen (Cupertino, CA)

Assignee: Fortinet, Inc.

H04L63/1425G06F9/455G06F9/545G06F16/9024G06F16/9038G06F16/9535G06F16/9537G06F21/57H04L43/045H04L43/06H04L63/10H04L67/306H04L67/535G06F16/2456

Abstract

Claims (68)

1 . A method comprising:

live capturing, by a sub-kernel component of a data collection system communicatively coupled to a data platform configured to perform security monitoring of a compute environment, a state snapshot of a compute resource within the compute environment, the live capturing performed by updating a master state snapshot with one or more delta state snapshots to avoid detectable disruption to the compute resource during the live capturing, wherein the master state snapshot comprises an entire state of the compute resource captured at a first capture time and a delta state snapshot comprises changes to the compute resource captured at a second capture time occurring after the first capture time;

determining, by the data collection system and based on the state snapshot, event data that represents one or more events occurring with respect to the compute resource; and

providing, by the data collection system, the event data to the data platform for use by the data platform in performing the security monitoring of the compute environment.

2 . The method of claim 1 , further comprising:

constructing, by the data collection system and based on the state snapshot, a mirror instance of the compute resource hosted on an additional compute resource;

wherein the determining of the event data based on the state snapshot is performed by analyzing the mirror instance of the compute resource.

3 . The method of claim 2 , wherein the constructing of the mirror instance of the compute resource includes:

transmitting, the master state snapshot to the additional compute resource during a first time period subsequent to the first capture time;

transmitting, during a second time period subsequent to the first time period, a first delta state snapshot of the one or more delta state snapshots to the additional compute resource, the first delta state snapshot indicating changes to the compute resource that occurred during the first time period subsequent to the first capture time; and

transmitting, during a third time period subsequent to the second time period, a second delta state snapshot of the one or more delta state snapshots to the additional compute resource, the second delta state snapshot indicating changes to the compute resource that occurred during the second time period subsequent to the first time period.

4 . The method of claim 3 , wherein the compute resource is paused during the third time period and the third time period is shorter than a time threshold configured to ensure the avoiding of the detectable disruption to the compute resource.

5 . The method of claim 3 , wherein:

the data platform operates at a first site associated with a platform side of a network communicatively coupling the data platform and the compute environment;

the compute environment operates at a second site associated with an environment side of the network, the second site physically remote from the first site;

the additional compute resource hosting the mirror instance is included, along with the compute resource, within the compute environment operating on the environment side of the network at the second site; and

the analyzing of the mirror instance is performed by one or more of:

the sub-kernel component of the data collection system operating on the environment side of the network in a sub-kernel space below an operating system of the compute resource, a kernel component of the data collection system operating on the environment side of the network in a kernel space of the operating system of the compute resource, or an application component of the data collection system operating on the environment side of the network in a user space of the operating system of the compute resource.

6 . The method of claim 3 , wherein:

the data platform operates at a first site associated with a platform side of a network communicatively coupling the data platform and the compute environment;

the compute environment operates at a second site associated with an environment side of the network, the second site physically remote from the first site;

the additional compute resource hosting the mirror instance operates on the platform side of the network at the first site; and

the analyzing of the mirror instance is performed by a backend component of the data collection system, the backend component operating on the platform side of the network.

7 . The method of claim 2 , wherein the analyzing of the mirror instance of the compute resource includes:

operating the mirror instance based on substantially identical input data as is received by the compute resource; and

deploying, to a user space of an operating system of the additional compute resource, an agent configured to determine the event data by monitoring the additional compute resource.

8 . The method of claim 7 , wherein the analyzing of the mirror instance of the compute resource further includes:

comparing a behavior of the compute resource and a behavior of the mirror instance as the compute resource and the mirror instance each operate in accordance with the substantially identical input data; and

determining, based on the comparing of the behaviors, a likelihood that an agent-sensitive security threat is operating in the compute environment.

9 . The method of claim 1 , wherein:

the compute resource is associated with a virtual machine executing on a processor that includes a plurality of processor cores; and

the method further comprises:

gaining control, by the sub-kernel component, of one or more processor cores of the plurality of processor cores; and

dedicating, by the sub-kernel component, the one or more processor cores to be used exclusively for operation of the sub-kernel component by assigning non-operational busywork to fill any extra bandwidth that the one or more processor cores have beyond the operation of the sub-kernel component.

10 . The method of claim 1 , wherein the event data is provided to the data platform for use by the data platform in performing the security monitoring by:

constructing a graph based on the event data, the graph comprising a plurality of nodes connected by a plurality of edges, wherein each node of the plurality of nodes represents a logical entity and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge; and

identifying, based on the graph, a security threat associated with the compute resource within the compute environment.

11 . A computer program product embodied in a non-transitory computer-readable storage medium and comprising computer instructions configured to direct a data collection system to perform a process comprising:

live capturing, by a sub-kernel component of the data collection system, a state snapshot of a compute resource within a compute environment, wherein the compute resource is communicatively coupled to a data platform configured to perform security monitoring of the compute environment, and wherein the live capturing is performed by updating a master state snapshot with one or more delta state snapshots to avoid detectable disruption to the compute resource during the live capturing, wherein the master state snapshot comprises an entire state of the compute resource captured at a first capture time and a delta state snapshot comprises changes to the compute resource captured at a second capture time occurring after the second capture time;

determining, based on the state snapshot, event data that represents one or more events occurring with respect to the compute resource; and

providing the event data to the data platform for use by the data platform in performing the security monitoring of the compute environment.

12 . The computer program product of claim 11 , wherein the process further comprises:

constructing, based on the state snapshot, a mirror instance of the compute resource hosted on an additional compute resource;

wherein the determining of the event data based on the state snapshot is performed by analyzing the mirror instance of the compute resource.

13 . The computer program product of claim 12 , wherein the constructing of the mirror instance of the compute resource includes:

transmitting, the master state snapshot to the additional compute resource during a first time period subsequent to the first capture time;

transmitting, during a second time period subsequent to the first time period, a first delta state snapshot of the one or more delta state snapshots to the additional compute resource, the first delta state snapshot indicating changes to the compute resource that occurred during the first time period subsequent to the first capture time; and

transmitting, during a third time period subsequent to the second time period, a second delta state snapshot of the one or more delta state snapshots to the additional compute resource, the second delta state snapshot indicating changes to the compute resource that occurred during the second time period subsequent to the first time period.

14 . The computer program product of claim 13 , wherein the compute resource is paused during the third time period and the third time period is shorter than a time threshold configured to ensure the avoiding of the detectable disruption to the compute resource.

15 . The computer program product of claim 12 , wherein the analyzing of the mirror instance of the compute resource includes:

operating the mirror instance based on substantially identical input data as is received by the compute resource; and

deploying, to a user space of an operating system of the additional compute resource, an agent configured to determine the event data by monitoring the additional compute resource.

16 . The computer program product of claim 15 , wherein the analyzing of the mirror instance of the compute resource further includes:

comparing a behavior of the compute resource and a behavior of the mirror instance as the compute resource and the mirror instance each operate in accordance with the substantially identical input data; and

determining, based on the comparing of the behaviors, a likelihood that an agent-sensitive security threat is operating in the compute environment.

17 . The computer program product of claim 11 , wherein: the compute resource is associated with a virtual machine executing on a processor that includes a plurality of processor cores; and the process further comprises:

gaining control, by the sub-kernel component, of one or more processor cores of the plurality of processor cores; and

dedicating, by the sub-kernel component, the one or more processor cores to be used exclusively for operation of the sub-kernel component by assigning non-operational busywork to fill any extra bandwidth that the one or more processor cores have beyond the operation of the sub-kernel component.

18 . A method comprising:

receiving, by a data platform configured to perform security monitoring of a compute environment, a live state snapshot of a compute resource within the compute environment, wherein the live state snapshot is live captured by a sub-kernel component of a data collection system communicatively coupled to the data platform, and wherein the live capture of the live state snapshot is performed by updating a master state snapshot with one or more delta state snapshots to avoid detectable disruption to the compute resource during the live capture, wherein the master state snapshot comprises an entire state of the compute resource captured at a first capture time and a delta state snapshot comprises changes to the compute resource captured at a second capture time occurring after the second capture time;

determining, by the data platform and based on the live state snapshot, event data that represents one or more events occurring with respect to the compute resource; and

using, by the data platform, the event data to perform the security monitoring of the compute environment.

19 . The method of claim 18 , further comprising:

constructing, by the data platform and based on the live state snapshot, a mirror instance of the compute resource hosted on an additional compute resource associated with the data platform;

wherein the determining of the event data based on the live state snapshot is performed by analyzing the mirror instance of the compute resource.

20 . The method of claim 18 , wherein the using of the event data to perform the security monitoring includes:

constructing a graph based on the event data, the graph comprising a plurality of nodes connected by a plurality of edges, wherein each node of the plurality of nodes represents a logical entity and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge; and

identifying, based on the graph, a security threat associated with the compute resource within the compute environment.

Assignments (1)

Continuity (7)

References Cited (400)