Zero day attack detection

1. A method comprising:

monitoring, by a sequence manager executed by a processor of a system, a sequence of transaction requests received by the system, wherein the sequence of transaction requests includes a path from a root transaction to a destination transaction;

determining, by the sequence manager, that a transaction request in the sequence of transaction requests is anomalous, wherein determining that the transaction request in the sequence of transaction requests is anomalous includes determining that an area associated with the path from the root transaction to the destination transaction deviates from a baseline area corresponding to verified transaction requests associated with the root transaction and the destination transaction; and

in response to determining that the transaction request is anomalous,

quarantining, by the sequence manager, the transaction request to prevent the system from processing the transaction request, and

while the transaction request is quarantined and prevented from being processed by the system, providing, by the sequence manager, the sequence of transaction requests to a sequence emulator, wherein the sequence emulator attempts to verify an output of the sequence of transaction requests.

2. The method of claim 1 , further comprising:

receiving, by the sequence manager, a notification from the sequence emulator that the output of the sequence of transaction requests cannot be verified; and

in response to the notification, instructing, by the sequence manager, the system to deny processing of the sequence of transaction requests.

3. The method of claim 2 , further comprising updating, by the sequence manager, a database to include the sequence of transaction requests with a label indicating that the sequence of transaction requests is associated with a vulnerability.

4. The method of claim 1 , further comprising:

receiving, by the sequence manager, a notification from the sequence emulator that the output of the sequence of transaction requests can be verified; and

in response to the notification, instructing, by the sequence manager, the system to allow processing of the sequence of transaction requests.

5. The method of claim 4 , further comprising updating, by the sequence manager, a database to include the sequence of transaction requests with a label indicating that the sequence of transaction requests is not associated with a vulnerability.

6. The method of claim 1 , wherein the sequence of transaction requests comprises a plurality of software transaction requests or a plurality of firmware transaction requests.

7. The method of claim 1 , wherein the sequence of transaction requests comprises a plurality of hardware transaction requests.

8. The method of claim 1 , wherein monitoring, by the sequence manager, the sequence of transaction requests comprises monitoring, by the sequence manager, the sequence of transaction requests via a probe, wherein the probe comprises a hardware probe or a software probe.

9. A system comprising:

a processor; and

a memory having instructions comprising a sequence manager stored thereon that, when executed by the processor, cause the sequence manager to perform operations comprising

monitoring a sequence of transaction requests received by the system, wherein the sequence of transaction requests includes a path from a root transaction to a destination transaction,

determining that a transaction request in the sequence of transaction requests is anomalous, wherein determining that the transaction request in the sequence of transaction requests is anomalous includes determining that an area associated with the path from the root transaction to the destination transaction deviates from a baseline area corresponding to verified transaction requests associated with the root transaction and the destination transaction, and

in response to determining that the transaction request is anomalous,

quarantining the transaction request to prevent the system from processing the transaction request, and

while the transaction request is quarantined and prevented from being processed by the system, providing the sequence of transaction requests to a sequence emulator, wherein the sequence emulator attempts to verify an output of the sequence of transaction requests.

10. The system of claim 9 , wherein the operations further comprise:

receiving a notification from the sequence emulator that the output of the sequence of transaction requests cannot be verified; and

in response to the notification, instructing the system to deny processing of the sequence of transaction requests.

11. The system of claim 10 , wherein the operations further comprise updating a database to include the sequence of transaction requests with a label indicating that the sequence of transaction requests is associated with a vulnerability.

12. The system of claim 9 , wherein the operations further comprise:

receiving a notification from the sequence emulator that the output of the sequence of transaction requests can be verified; and

in response to the notification, instructing the system to allow processing of the sequence of transaction requests.

13. The system of claim 12 , wherein the operations further comprise updating a database to include the sequence of transaction requests with a label indicating that the sequence of transaction requests is not associated with a vulnerability.

14. The system of claim 9 , wherein the sequence of transaction requests comprises a plurality of software transaction requests, a plurality of hardware transaction requests, or a plurality of firmware transaction requests.

15. The system of claim 9 , wherein the sequence of transaction requests comprises a plurality of hardware transaction requests.

16. The system of claim 9 , wherein monitoring the sequence of transaction requests comprises monitoring the sequence of transaction requests via a probe, wherein the probe comprises a hardware probe or a software probe.

17. A computer-readable storage medium having computer-executable instructions comprising a sequence manager stored thereon that, when executed by a processor of a system, cause the sequence manager to perform operations comprising:

monitoring a sequence of transaction requests received by the system, wherein the sequence of transaction requests includes a path from a root transaction to a destination transaction;

determining that a transaction request in the sequence of transaction requests is anomalous, wherein determining that the transaction request in the sequence of transaction requests is anomalous includes determining that an area associated with the path from the root transaction to the destination transaction deviates from a baseline area corresponding to verified transaction requests associated with the root transaction and the destination transaction; and

in response to determining that the transaction request is anomalous,

quarantining the transaction request to prevent the system from processing the transaction request, and

while the transaction request is quarantined and prevented from being processed by the system, providing the sequence of transaction requests to a sequence emulator, wherein the sequence emulator attempts to verify an output of the sequence of transaction requests.

18. The computer-readable storage medium of claim 17 , wherein the operations further comprise:

receiving a notification from the sequence emulator that the output of the sequence of transaction requests cannot be verified;

in response to the notification, instructing the system to deny processing of the sequence of transaction requests; and

updating a database to include the sequence of transaction requests with a label indicating that the sequence of transaction requests is associated with a vulnerability.

19. The computer-readable storage medium of claim 17 , wherein the operations further comprise:

receiving a notification from the sequence emulator that the output of the sequence of transaction requests can be verified;

in response to the notification, instructing the system to allow processing of the sequence of transaction requests; and

updating a database to include the sequence of transaction requests with a label indicating that the sequence of transaction requests is not associated with a vulnerability.

20. The computer-readable storage medium of claim 17 , wherein monitoring the sequence of transaction requests comprises monitoring the sequence of transaction requests via a probe, wherein the probe comprises a hardware probe or a software probe.