Computer system providing anomaly detection within a virtual computing sessions and related methods
A method may include running virtual sessions on a virtualization server for a plurality of client devices associated with respective users, with the virtual sessions being responsive to traffic from the client devices. The method may further include generating baseline traffic patterns for the users based upon the traffic from respective client devices during the virtual sessions, monitoring traffic during a new virtual session for a given client device and detecting an anomaly therein relative to at least one of the baseline traffic patterns, and generating an anomaly alert based upon detecting the anomaly.
1. A method comprising:
running virtual sessions on a virtualization server corresponding to a published application for a plurality of client devices associated with respective users, the client devices having user input devices associated therewith, and the virtual sessions being responsive to user input device traffic from a plurality of different virtual drivers at the client devices over a plurality of respective virtual channels;
generating a heat map of user input device behavior including printing traffic and universal serial bus (USB) traffic based upon the traffic from the virtual drivers of respective client devices during the virtual sessions across the plurality of virtual channels;
determining baseline user input traffic patterns for printing traffic and USB traffic for the users at the virtualization server based upon the heat map, and a normal usage pattern for the published application, the USB traffic relating to file copying;
monitoring traffic over the virtual channels at the virtualization server during a new virtual session for a given client device and detecting an anomaly therein relative to the baseline user input traffic patterns for different users and the normal usage pattern for the published application based upon a multi-variant Gaussian distribution; and
generating an anomaly alert based upon detecting the anomaly.
2. The method of claim 1 wherein the user input devices comprise keyboards; and wherein determining the baseline user input traffic patterns comprises determining the baseline user input traffic patterns based upon traffic from the keyboards to the client devices during the virtual sessions.
3. The method of claim 2 wherein determining the baseline user input traffic patterns further comprises determining the baseline user input traffic patterns based upon a typing speed associated with the traffic from the keyboards during the virtual sessions.
4. The method of claim 1 wherein determining the baseline user input traffic patterns comprises determining the baseline user input traffic patterns based upon machine learning.
5. The method of claim 1 wherein the virtual sessions comprise at least one of virtual desktop sessions and virtual application sessions.
6. The method of claim 1 wherein the user input devices comprise a respective mouse associated with each client device; and wherein generating the heat map comprises generating the heat map based upon user mouse click behavior.
7. A virtualization server comprising:
a memory and a processor configured to cooperate with the memory to
run virtual sessions on a virtualization server corresponding to a published application for a plurality of client devices associated with respective users, the client devices having user input devices associated therewith, and the virtual sessions being responsive to user input device traffic from a plurality of different virtual drivers at the client devices over a plurality of respective virtual channels;
generate a heat map of user input device behavior including printing traffic and universal serial bus (USB) traffic based upon the traffic from the virtual drivers of respective client devices during the virtual sessions across the plurality of virtual channels,
determine baseline user input traffic patterns for printing traffic and USB traffic for the users based upon the heat map, and a normal usage pattern for the published application, the USB traffic relating to file copying;
monitor traffic over the virtual channels during a new virtual session for a given client device and detect an anomaly therein relative to the baseline user input traffic patterns for different users and the normal usage pattern for the published application based upon a multi-variant Gaussian distribution; and
generate an anomaly alert based upon detecting the anomaly.
8. The virtualization server of claim 7 wherein the user input devices comprise keyboards; and wherein the processor determines the baseline user input traffic patterns based upon traffic from the keyboards to the client devices during the virtual sessions.
9. The virtualization server of claim 8 wherein the processor determines the baseline user input traffic patterns based upon a typing speed associated with the traffic from the keyboards during the virtual sessions.
10. The virtualization server of claim 7 wherein the user input devices comprise a respective mouse associated with each client device; and wherein the processor generates the heat map based upon user mouse click behavior.
11. A non-transitory computer-readable medium having computer-executable instructions for causing a processor of a virtualization server to perform steps comprising:
running virtual sessions on the virtualization server corresponding to a published application for a plurality of client devices associated with respective users, the client devices having user input devices associated therewith, and the virtual sessions being responsive to user input device traffic from a plurality of different virtual drivers at the client devices over a plurality of respective virtual channels;
generating a heat map of user input device behavior including printing traffic and universal serial bus (USB) traffic based upon the traffic from the virtual drivers of respective client devices during the virtual sessions across the plurality of virtual channels;
determining baseline user input traffic patterns for printing traffic and USB traffic for the users over a period of time based upon the heat map, and a normal usage pattern for the published application, the USB traffic relating to file copying;
monitoring traffic over the virtual channels during a new virtual session for a given client device and detecting an anomaly therein relative to the user input baseline traffic patterns for different users and the normal usage pattern for the published application based upon a multi-variant Gaussian distribution; and
generating an anomaly alert based upon detecting the anomaly.
12. The non-transitory computer-readable medium of claim 11 wherein the user input devices comprise keyboards; and wherein determining the baseline user input traffic patterns comprises determining the baseline user input traffic patterns based upon traffic from the keyboards to the client devices during the virtual sessions.
13. The non-transitory computer-readable medium of claim 12 wherein determining the baseline user input traffic patterns further comprises determining the baseline user input traffic patterns based upon a typing speed associated with the traffic from the keyboards during the virtual sessions.
14. The non-transitory computer-readable medium of claim 11 wherein the user input devices comprise a respective mouse associated with each client device; and wherein generating the heat map comprises generating the heat map based upon user mouse click behavior.