Systems and methods for zone-based intrusion detection
Systems and methods for zone-based intrusion detection are described herein. The system may comprise a multi-tenant system; a server communicatively coupled with the multi-tenant system; a zone-based intrusion detection module running on the server; a zone within the server, the zone being a tenant and including at least one process running on it; and a debugger module that examines the process in real-time.
1. A method for zone-based intrusion detection, the method comprising:
providing a cloud-based multi-tenant system, wherein each tenant of the multi-tenant system represents a virtual computing system within a zone of the cloud for a customer;
providing a server communicatively coupled to the tenants within the multi-tenant system; and
providing a zone-based intrusion detection system (ZIDS) module running on the server that is configured for:
monitoring unencrypted live traffic in each zone from within the server,
analyzing and executing processes in real time in each zone, and
detecting zone-based intrusion for each tenant of the cloud-based multi-tenant system based on the monitored live traffic, an inspected software, and the analyzed process.
2. The method of claim 1 , wherein the ZIDS module is running on the same system as the tenants of the multi-tenant system.
3. The method of claim 1 , wherein the ZIDS module resides in a global zone and is immune from compromise from the tenants of the multi-tenant system.
4. The method of claim 1 , wherein the ZIDS module directly inspects the tenants of the multi-tenant system running one or more processes.
5. The method of claim 1 , wherein providing the zone within the server includes providing the tenant of the multi-tenant system within the server.
6. The method of claim 1 , wherein at least one process is running on the zone.
7. The method of claim 1 , further comprising using a debugger module to examine a process in real-time.
8. The method of claim 7 , wherein the debugger module is DTrace.
9. The method of claim 1 , wherein the zone has one-way access only.
10. The method of claim 1 , wherein the ZIDS module writes to a log.
11. The method of claim 1 , wherein the ZIDS module sends e-mails.
12. A system for zone-based intrusion detection, the system comprising:
a processing system having instructions stored on non-transitory computer-readable storage medium that when executed cause the processing system to:
provide a cloud-based multi-tenant system, wherein each tenant of the multi-tenant system represents a virtual computing system within a zone of the cloud for a customer;
provide a server communicatively coupled to the tenants within the multi-tenant system; and
provide a zone-based intrusion detection system (ZIDS) module running on the server that is configured for:
monitoring unencrypted live traffic in each zone from within the server,
analyzing and executing processes in real time in each zone, and
detecting zone-based intrusion based on the monitored live traffic, an inspected software, and the analyzed process, for each tenant of the cloud-based multi-tenant system, the ZIDS module and the server residing in a global zone that cannot be compromised by any tenant of the multi-tenant system.
13. The system of claim 12 , wherein the ZIDS module is running on the same system as the tenants of the multi-tenant system.
14. The system of claim 12 , wherein the ZIDS module resides in the global zone and is immune from compromise from the tenants of the multi-tenant system.
15. The system of claim 12 , wherein the ZIDS module directly inspects the tenants of the multi-tenant system running one or more processes.
16. The system of claim 12 , wherein at least one of the zones is at least one of the tenants.
17. The system of claim 12 , wherein the zone includes at least one process running on it.
18. The system of claim 12 , further comprising a debugger module that examines a process in real-time.
19. The system of claim 18 , wherein the debugger module is DTrace.
20. A system for zone-based intrusion detection, the system comprising:
a cloud-based multi-tenant system, wherein each tenant of the multi-tenant system represents a virtual computing system within a zone of the cloud for a customer, and further wherein each tenant is a container built into an operating system of the cloud-based multi-tenant system;
a server communicatively coupled to the tenants within the multi-tenant system; and
a zone-based intrusion detection system (ZIDS) module running on the server that is configured for:
monitoring unencrypted live traffic in each zone from within the server,
analyzing and executing processes in real time in each zone, and
detecting zone-based intrusion for each tenant of the cloud-based multi-tenant system based on the monitored live traffic, an inspected software, and the analyzed process.
21. The system of claim 20 , wherein the ZIDS module is running on the same system as the tenant of the multi-tenant system.
22. The system of claim 20 , wherein the ZIDS module resides in a global zone and is immune from compromise from the tenants of the multi-tenant system.
23. The system of claim 20 , wherein the ZIDS module directly inspects the tenants of the multi-tenant system running one or more processes.
24. The system of claim 20 , at least one of the zones is at least one of the tenants.
25. The system of claim 20 , wherein the zone includes at least one process running on it.
26. The system of claim 20 , further comprising a debugger module that examines a process in real-time.
27. The system of claim 26 , wherein the debugger module is DTrace.
28. A system for zone-based intrusion detection, the system comprising:
a cloud-based multi-tenant system, wherein each tenant of the multi-tenant system represents a virtual computing system within a zone of the cloud for a customer;
a server communicatively coupled to the tenants within the multi-tenant system; and
a zone-based intrusion detection system (ZIDS) module running on the same server as the tenants of the multi-tenant system and residing in a global zone and immune from compromise by the tenants of the multi-tenant system, the ZIDS module is configured for:
directly inspecting the tenants which are running one or more processes;
monitoring unencrypted live traffic in each zone from within the server;
executing processes in real time in each zone;
analyzing the executing processes using a debugger module; and
detecting zone-based intrusion for each inspected tenant of the cloud-based multi-tenant system based on the monitored live traffic, an inspected software, and the analyzed processes.