Determining the chronology and causality of events

Abstract

An example method includes calculating latency bounds for communications from two sensors to a collector (i.e., maximum and minimum latencies). After the collector receives an event report from the first sensor and an event report form the second sensor, the collector can determine, using the latency bounds, whether one event likely preceded the other.

1 . A computer-implemented method comprising:
 receiving, from a first sensor at a first time, a description of a first event;   receiving, from a second sensor at a second time, a description of a second event; and   determining that the first event preceded the second event.   
     
     
         2 . The computer-implemented method of  claim 1 , further comprising:
 determining a minimum latency associated with the first sensor;   determining a maximum latency associated with the second sensor; and   wherein the determining that the first event preceded the second event comprises:
 comparing the first time minus the minimum latency for the first sensor with the second time minus the maximum latency for the second sensor. 
   
     
     
         3 . The computer-implemented method of  claim 2 , further comprising:
 determining a maximum latency associated with the first sensor;   determining a minimum latency associated with the second sensor; and   determining that the first event caused the second event by determining that the first time minus the maximum latency associated with the first sensor is within a predetermined range with the second time minus the minimum latency associated with the second sensor.   
     
     
         4 . The computer-implemented method of  claim 3 , wherein determining that the first event caused the second event is based on the type of event of the first event and the type of event of the second event. 
     
     
         5 . The computer-implemented method of  claim 4 , wherein the second event is a data center attack. 
     
     
         6 . The computer-implemented method of  claim 1 , further comprising:
 receiving, from the first sensor, a description of a third event;   receiving, from the second sensor, a description of a fourth event;   wherein the determining that the first event preceded the second event comprises:
 determining that the first event preceded the third event; 
 determining that the third event preceded the fourth event; and 
 determining that the fourth event preceded the second event. 
   
     
     
         7 . The computer-implemented method of  claim 6 , wherein:
 determining that the first event preceded the third event comprises comparing:
 a timestamp associated with the first event with a timestamp associated with the third event; or 
 a sequence number associated with the first event with a sequence number associated with the third event; and 
   determining that the third event preceded the fourth event comprises comparing:
 an event type associated with the third event with an event type associated with the fourth event. 
   
     
     
         8 . The computer-implemented method of  claim 7 , wherein the first event is a data center attack, the method further comprising:
 determining that the second event did not cause the first event.   
     
     
         9 . The computer-implemented method of  claim 1 , wherein the second event is a process starting. 
     
     
         10 . The computer-implemented method of  claim 1 , wherein the second time is before the first time. 
     
     
         11 . A non-transitory computer-readable medium having computer readable instructions stored thereon that, when executed by a processor of a computer, cause the computer to:
 receive, from a first sensor at a first time, a description of a first event;   receive, from the first sensor, a description of a third event;   receive, from a second sensor at a second time, a description of a second event;   receive, from the second sensor, a description of a fourth event; and   determine that the first event preceded the second event by:
 determining that the first event preceded the third event; 
 determining that the third event preceded the fourth event; and 
 determining that the fourth event preceded the second event. 
   
     
     
         12 . The non-transitory computer-readable medium of  claim 11 , wherein:
 the instructions that cause the computer to determine that the first event preceded the third event further cause the computer to compare:
 a timestamp associated with the first event with a timestamp associated with the third event; or 
 a sequence number associated with the first event with a sequence number associated with the third event; and 
   the instructions that cause the computer to determine that the third event preceded the fourth event further cause the computer to compare an event type associated with the third event with an event type associated with the fourth event.   
     
     
         13 . The non-transitory computer-readable medium of  claim 12 , wherein the first event is a data center attack and the instructions further cause the computer to:
 determine that the second event did not cause the first event.   
     
     
         14 . The computer-implemented method of  claim 1 , wherein the second sensor is installed on a virtual machine and the second event is a process starting. 
     
     
         15 . The computer-implemented method of  claim 1 , wherein the second time is before the first time. 
     
     
         16 . A system comprising:
 a processor;   a computer-readable medium; and   non-transitory computer-readable instructions stored thereon that, when executed by the processor, cause the system to:
 determine a minimum latency associated with a first sensor; 
 receive, from the first sensor at a first time, a description of a first event; 
 determine a maximum latency associated with a second sensor; 
 receive, from the second sensor at a second time, a description of a second event; and 
 determine that the first event preceded the second event by:
 comparing the first time minus the minimum latency for the first sensor with the second time minus the maximum latency for the second sensor. 
 
   
     
     
         17 . The system of  claim 16 , wherein the instructions further cause the system to:
 determine a maximum latency associated with the first sensor;   determine a minimum latency associated with the second sensor; and   determine that the first event caused the second event by determining that the first time minus the maximum latency associated with the first sensor is within a predetermined range with the second time minus the minimum latency associated with the second sensor.   
     
     
         18 . The system of  claim 17 , wherein the instructions that cause the system to determine that the first event caused the second event do so based on the type of event of the first event and the type of event of the second event. 
     
     
         19 . The system of  claim 18 , wherein the second event is a data center attack. 
     
     
         20 . The system of  claim 16 , wherein the sensor is installed on a virtual machine and the second event is a process starting up.