Real-time monitoring for ransomware attacks using exception-level transition metrics
Aspects of the disclosure include a dynamic cloud workload reallocation based on an active ransomware attack. An example method includes receiving a first message that a computing instance is potentially infected by ransomware. The method further includes receiving a security state-based metric related to the computing instance based at least in part on the first message. The method further includes comparing the security state-based metric to a threshold metric. The method further incudes determining a likelihood of a ransomware attack based at least in part on the comparison. The method further includes transmitting second message to a job scheduler to reschedule workloads directed toward the computing instance based at least in part on the determination.
1 . A computer-implemented method, comprising:
detecting that a computing instance is potentially infected by ransomware;
triggering an operation that monitors transitions in a cache associated with an exception level of a processor of the computing instance, wherein the operation comprises:
collecting a security metric associated with the exception level of the processor, wherein:
the security metric comprises a number of times the processor utilizes an exception level indicating a secure state of the processor;
comparing the security metric to a threshold metric; and
determining that a ransomware attack occurred based at least in part on the comparing of the security metric to the threshold metric; and
transmitting a message to a job scheduler to reschedule workloads directed toward the computing instance based at least in part on the determination that the ransomware attack occurred.
2 . The computer-implemented method of claim 1 , wherein detecting that the computing instance is potentially infected by ransomware comprises:
detecting a modification of a mapping of a cache location to a memory location.
3 . The computer-implemented method of claim 1 , wherein detecting that the computing instance is potentially infected by ransomware comprises:
detecting that a number of attempted transitions to a secure state by the computing instance exceeds a threshold number.
4 . The computer-implemented method of claim 1 , wherein the method further comprises migrating the workloads away from the computing instance.
5 . The computer-implemented method of claim 1 , wherein the method further comprises:
generating a first cryptographic bitmap comprising a first row of encryption-related data associated with a cache,
generating a second cryptographic bitmap comprising a second row of encryption-related data associated with the cache;
performing, on the first row and the second row, a mathematical exclusive operation to derive a delta value;
comparing the delta value to a threshold value,
wherein determining that the ransomware attack occurred is further based on comparing-the delta value to the threshold value.
6 . The computer-implemented method of claim 1 , wherein the method further comprises repaving the computing instance based at least in part on the determination that the ransomware attack occurred.
7 . The computer-implemented method of claim 1 , wherein:
the exception level is one of a plurality of exception levels associated respectively with privilege levels for accessing one or more secure resources.
8 . A cloud infrastructure node, comprising:
a processor; and
a computer-readable medium including instructions that, when executed by the processor, cause the processor to:
detecting that a computing instance is potentially infected by ransomware;
trigger an operation that monitors transitions in a cache associated with an exception level of a processor of the computing instance, wherein the operation comprises:
collecting a security metric associated with the exception level of the processor, wherein:
the security metric comprises a number of times the processor utilizes an exception level indicating a secure state of the processor;
compare the security metric to a threshold metric; and
determine that a ransomware attack occurred based at least in part on the comparing of the security metric to the threshold metric; and
transmit a second message to a job scheduler to reschedule workloads directed toward the computing instance based at least in part on the determination that the ransomware attack occurred.
9 . The cloud infrastructure node of claim 8 , wherein detecting that the computing instance is potentially infected by ransomware comprises:
detecting a modification of a mapping of a cache location to a memory location.
10 . The cloud infrastructure node of claim 8 , wherein detecting that the computing instance is potentially infected by ransomware comprises:
detecting that a number of attempted transitions to a secure state by the computing instance exceeds a threshold number.
11 . The cloud infrastructure node of claim 8 , wherein the instructions further cause the processor to migrate the workloads away from the computing instance.
12 . The cloud infrastructure node of claim 8 , wherein the instructions further cause the processor to:
generate a first cryptographic bitmap comprising a first row of encryption related data associated with a cache,
generating a second cryptographic bitmap comprising a second row of encryption related data associated with the cache;
perform, on the first row and the second row, a mathematical exclusive operation to derive a delta value;
comparing the delta value to a threshold value,
wherein determining that the ransomware attack occurred is further based on comparing-the delta value to the threshold value.
13 . The cloud infrastructure node of claim 8 , wherein the instructions further cause the processor to repave the computing instance based at least in part on the determination that the ransomware attack occurred.
14 . The cloud infrastructure node of claim 8 , wherein:
the exception level is one of a plurality of exception levels associated respectively with privilege levels for accessing one or more secure resources.
15 . A non-transitory computer-readable medium including stored thereon a sequence of instructions that, when executed by a processor of a cloud infrastructure node, causes the processor to perform operations comprising:
detecting that a computing instance is potentially infected by ransomware;
triggering an operation that monitors transitions in a cache associated with an exception level of a processor of the computing instance, wherein the operation comprises:
collecting a security metric associated with the exception level of the processor, wherein:
the security metric comprises a number of times the processor utilizes an exception level indicating a secure state of the processor;
comparing the security metric to a threshold metric; and
determining that a ransomware attack occurred based at least in part on the comparing of the security metric to the threshold metric; and
transmitting a second message to a job scheduler to reschedule workloads directed toward the computing instance based at least in part on the determination that the ransomware attack occurred.
16 . The non-transitory computer-readable medium of claim 15 , wherein detecting that the computing instance is potentially infected by ransomware comprises:
detecting a modification of a mapping of a cache location to a memory location.
17 . The non-transitory computer-readable medium of claim 15 , wherein detecting that the computing instance is potentially infected by ransomware comprises:
detecting that a number of attempted transitions to a secure state by the computing instance exceeds a threshold number.
18 . The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise migrating the workloads away from the computing instance.
19 . The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise:
generating a first cryptographic bitmap comprising a first row of encryption related data associated with a cache,
generating a second cryptographic bitmap comprising a second row of encryption related data associated with the cache;
performing, on the first row and the second row, a mathematical exclusive operation to derive a delta value;
comparing the delta value to a threshold value,
wherein determining that the ransomware attack occurred is further based on comparing-the delta value to the threshold value.
20 . The non-transitory computer-readable medium of claim 15 , wherein:
the exception level is one of a plurality of exception levels associated respectively with privilege levels for accessing one or more secure resources.