Computer implemented techniques for detecting, investigating and remediating security violations to IT infrastructure

US10375101B2 · kind B2 · utility

Assignee

• International Business Machines Corporation · US

Inventors

• Stefan Berger · Raubling, DE
• Yangyi Chen · Bloomington, US
• Xin Hu · White Plains, US
• Dimitrious Pendarakis · Westport, US
• Josyula R. Rao · Briarcliff Manor, US
• Reiner Sailer · Scarsdale, US
• Douglas Lee Schales · Campion Road, US
• Marc Philippe Stoecklin · Bern, CH

Key dates

• Filing date: Mar 7, 2016
• Grant date: Aug 6, 2019
• Expiry date: Mar 7, 2036

Classification

• Technology area (CPC H): Electricity
• CPC primary: H04L63/14
• WIPO field: Digital communication
• WIPO sector: Electrical engineering

Abstract

A method includes collecting system calls and call parameters invoked by monitored applications for target computer systems. The system calls and call parameters are received from operating system kernels on the plurality of target computer systems. Sequences of systems calls and call parameters of the monitored applications are correlated among different target computer systems to deduce malicious activities. Remedial action(s) are performed in response to malicious activities being deduced as being malicious by the correlating. Another method includes determining that network activity at a specific time is deemed to be suspicious. Using IP addresses involved in the suspicious network activity, computer system(s) are determined that are sources of the suspicious network activity. Based on the specific time and the determined computer system(s), application(s) are determined that are executing on the determined computer system(s) that are causing the suspicious network activity. Remedial action(s) are performed for the determined computer system(s).