Dynamic detection strategies for kernel sensors
Detection strategies for a node are selected and deployed based on the amount of data collection that is associated with various modes of telemetry available to the node.
1 . A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for deploying strategies to detect malicious activity on an endpoint, the computer instructions configuring one or more processors to perform the steps of:
executing a sensor to monitor kernel activity on a node;
with an analytics component for the node, providing a strategy for detecting malicious behavior on the node;
providing a plurality of modes of telemetry collection for the strategy including two or more of:
a data collection tap built into a kernel subsystem,
an on-demand collection hook for exported kernel symbols, and
an on-demand collection hook for kernel function entry or return;
enumerating metadata for the sensor, the metadata including configuration information used to initialize the sensor;
selecting one of the plurality of modes of telemetry collection for the strategy based on a highest performing one of the plurality of modes of telemetry collection corresponding to the metadata for the sensor; and
applying the strategy to the one of the plurality of modes of telemetry collection to monitor for malicious behavior on the node.
2 . The computer program product of claim 1 , further comprising code that performs the step of prioritizing the strategy relative to one or more other ones of a plurality of strategies for monitoring the node based on a rate of data collection associated with the strategy on the node.
3 . The computer program product of claim 1 , wherein the data collection tap includes a tracepoint.
4 . The computer program product of claim 1 , wherein the on-demand collection hook includes a kprobe.
5 . The computer program product of claim 1 , wherein the on-demand collection hook includes a kretprobe.
6 . A method for deploying strategies to detect malicious activity on an endpoint, the method comprising:
executing a sensor to monitor kernel activity on a node;
with an analytics component for the node, providing a strategy for detecting malicious behavior on the node with data from the sensor;
providing a plurality of modes of telemetry collection for the strategy, including at least one on-demand collection hook for kernel function entry or return;
enumerating metadata for the sensor, the metadata including configuration information used to initialize the sensor;
selecting one of the plurality of modes of telemetry collection for the strategy based on a highest performing one of the plurality of modes of telemetry collection corresponding to the metadata for the sensor; and
prioritizing the strategy relative to one or more other strategies for monitoring the node based on a rate of data collection associated with the one of the plurality of modes of telemetry collection.
7 . The method of claim 6 wherein the plurality of modes include one or more of: a data collection tap built into a kernel subsystem, and an on-demand collection hook for exported kernel symbols.
8 . The method of claim 6 , wherein the strategy for detecting malicious behavior includes at least one memory protection strategy.
9 . The method of claim 6 , wherein the strategy for detecting malicious behavior includes at least one stack pivot detection strategy.
10 . The method of claim 6 , wherein the strategy for detecting malicious behavior includes at least one privilege escalation detection strategy.
11 . The method of claim 6 , wherein the strategy for detecting malicious behavior includes at least one interactive shell detection strategy.
12 . The method of claim 6 , wherein the strategy for detecting malicious behavior includes at least one of a kernel payload detection strategy and a kernel module loading detection strategy.
13 . The method of claim 6 , wherein the strategy for detecting malicious behavior includes at least one spectre-meltdown detection strategy.
14 . The method of claim 6 , wherein selecting one of the plurality of modes of telemetry collection includes selecting from among multiple methods of telemetry collection from different data sources based on data-source availability.
15 . The method of claim 6 , wherein selecting one of the plurality of modes of telemetry collection includes selecting from among multiple methods of telemetry collection depending on a kernel version or one or more build options for the node.
16 . The method of claim 6 , wherein the node includes one or more of a cloud-based workload instance, a legacy computing system, and a containerized system.
17 . The method of claim 6 , further comprising providing a resource threshold for at least one sensor process providing telemetry on the node, and limiting an execution of the sensor process when a resource usage by the sensor process exceeds the resource threshold.
18 . A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for deploying strategies to detect malicious activity on an endpoint, the computer instructions configuring one or more processors to perform the steps of:
executing a sensor to monitor kernel activity on a node;
with an analytics component for the node, providing a strategy for detecting malicious behavior on the node;
providing a plurality of modes of telemetry collection for the strategy including two or more of:
a data collection tap built into a kernel subsystem,
an on-demand collection for exported kernel symbols, and
an on-demand collection for kernel function entry or return;
enumerating metadata for the sensor, the metadata including configuration information used to initialize the sensor;
selecting one of the plurality of modes of telemetry collection for the strategy based on a highest performing one of the plurality of modes of telemetry collection corresponding to the metadata for the sensor; and
applying the strategy to the one of the plurality of modes of telemetry collection to monitor for malicious behavior on the node.
19 . The computer program product of claim 18 , further comprising code that performs the step of prioritizing the strategy relative to one or more other ones of a plurality of strategies for monitoring the node based on a rate of data collection associated with the strategy on the node.
20 . The computer program product of claim 18 , wherein the on-demand collection includes at least one of a kprobe and a kretprobe.