Learned control flow monitoring and enforcement of unobserved transitions
Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining a learned control flow diagram for a process on a computing system and monitoring execution of the process on the computing system using the control flow diagram. An unobserved transition is determined based on the learned control flow diagram and the unobserved transition is classified as safe or unsafe based on a monitoring component analysis. An action is performed based on the safety classification and the learned control flow diagram.
1 . A method for monitoring a computing system, comprising:
determining a learned control flow diagram for a process executed on a computing system by observing executions of transitions during an observation period during which safe executions of transitions are permitted to execute and be observed;
monitoring execution of the process on the computing system using the learned control flow diagram;
determining an unobserved transition of the process based at least in part on the unobserved transition not being represented in the learned control flow diagram;
determining a classification of the unobserved transition as being safe by analyzing, using a monitoring component, the unobserved transition; and
performing an action based at least in part on the classification and the learned control flow diagram, the action including adding the unobserved transition to the learned control flow diagram.
2 . The method of claim 1 , wherein analyzing the unobserved transition comprises statically analyzing the transition.
3 . The method of claim 1 , wherein determining the classification for the unobserved transition comprises:
determining a context for the transition;
performing a static analysis of the unobserved transition; and
determining the unobserved transition is safe in response to determining a reason for the transition based at least in part on the context and the static analysis.
4 . The method of claim 1 , wherein determining the classification for the unobserved transition comprises:
determining a type of transition for the unobserved transition;
determining a destination for the unobserved transition;
determining a characteristic of the destination; and
determining the classification using a machine learned model using inputs of the type of transition, the destination, the characteristic of the destination, and the learned control flow diagram.
5 . The method of claim 1 , wherein determining the classification for the unobserved transition comprises:
determining a destination linked by the unobserved transition; and
determining a risk score associated with the destination, and wherein the classification is based at least in part on the risk score of the destination.
6 . The method of claim 5 , wherein the risk score is further based on at least one of:
a presence of a system call at the destination;
permissions associated with the destination;
a presence of propagating transitions to additional destinations; or
a presence of the destination within the learned control flow diagram.
7 . A system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
determining a learned control flow diagram for a process executed on a computing system by observing executions of transitions during an observation period during which safe executions of transitions are permitted to execute and be observed;
monitoring execution of the process on the computing system using learned control flow diagram;
determining an unobserved transition of the process based at least in part on the unobserved transition not being represented in the learned control flow diagram;
determining a classification of the unobserved transition as being safe by analyzing, using a monitoring component, the unobserved transition; and
performing an action based at least in part on the classification and the learned control flow diagram, the action including adding the unobserved transition to the learned control flow diagram.
8 . The system of claim 7 , wherein determining the classification for the unobserved transition comprises:
determining a context for the transition;
performing a static analysis of the unobserved transition; and
determining the unobserved transition is safe in response to determining a reason for the transition based at least in part on the context and the static analysis.
9 . The system of claim 7 , wherein determining the classification for the unobserved transition comprises:
determining a type of transition for the unobserved transition;
determining a destination for the unobserved transition;
determining a characteristic of the destination; and
determining the classification using a set of heuristics defining the classification in response to the type of transition, the destination, the characteristic of the destination, and the learned control flow diagram.
10 . The system of claim 7 , wherein determining the classification for the unobserved transition comprises:
determining a destination linked by the unobserved transition; and
determining a risk score associated with the destination, and wherein the classification is based at least in part on the risk score of the destination.
11 . The system of claim 7 , wherein determining the classification for the unobserved transition comprises:
determining a type of transition for the unobserved transition;
determining a destination for the unobserved transition;
determining a characteristic of the destination; and
determining the classification using a machine learned model using inputs of the type of transition, the destination, the characteristic of the destination, and the learned control flow diagram.
12 . The system of claim 7 , wherein analyzing the unobserved transition comprises statically analyzing the transition.
13 . One or more non-transitory computer-readable media storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to:
determine a learned control flow diagram for a process executed on a computing system by observing executions of transitions during an observation period during which safe executions of transitions are permitted to execute and be observed;
monitor execution of the process on the computing system using the learned control flow diagram;
determine an unobserved transition of the process based at least in part on the unobserved transition not being represented in the learned control flow diagram;
determine a classification of the unobserved transition as being safe by analyzing, using a monitoring component, the unobserved transition; and
performing an action based at least in part on the classification and the learned control flow diagram, the action adding the unobserved transition to the learned control flow diagram.
14 . The one or more non-transitory computer-readable media of claim 13 , wherein:
the action comprises allowing execution of the unobserved transition in response to the classification being safe.
15 . The one or more non-transitory computer-readable media of claim 13 , wherein the instructions to determine the classification for the unobserved transition comprises further instructions to:
determine a context for the transition;
perform a static analysis of the unobserved transition; and
determine the unobserved transition is safe in response to determining a reason for the transition based at least in part on the context and the static analysis.
16 . The one or more non-transitory computer-readable media of claim 13 , wherein the instructions to determine the classification for the unobserved transition comprises further instructions to:
determine a type of transition for the unobserved transition;
determine a destination for the unobserved transition;
determine a characteristic of the destination; and
determine the classification using a set of heuristics defining the classification in response to the type of transition, the destination, the characteristic of the destination, and the learned control flow diagram.
17 . The one or more non-transitory computer-readable media of claim 13 , wherein the instructions to determine the classification for the unobserved transition comprises further instructions to:
determine a type of transition for the unobserved transition;
determine a destination for the unobserved transition;
determine a characteristic of the destination; and
determine the classification using a machine learned model using inputs of the type of transition, the destination, the characteristic of the destination, and the learned control flow diagram.
18 . The one or more non-transitory computer-readable media of claim 13 , wherein the instructions to determine the classification for the unobserved transition comprises further instructions to:
determine a destination linked by the unobserved transition; and
determine a risk score associated with the destination, and wherein the classification is based at least in part on the risk score of the destination.