Realtime event detection

Abstract

An event handler implements a state machine or similar construct for processing of complex event chains as incremental events are detected. This approach advantageously limits processing to monitoring for and responding to a next event in a sequence of events, and supports complex event detection in a manner that scales efficiently in time and computation.

What is claimed is: 
     
         1 . A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, causes the one or more computing devices to perform the steps of:
 identifying a first event in a sequence of events associated with malware on an endpoint, wherein identifying the first event includes traversing an event graph among a sequence of causal events in reverse chronological order to a root cause of the malware;   configuring an event handler as a plurality of states for malware detection on the endpoint based on the sequence of events,
 the event handler including a first state of the plurality of states configured to monitor for an occurrence of the first event in the sequence of events, and to respond to the occurrence of the first event in the sequence of events by transitioning to a second state of the plurality of states, 
 the event handler configured in the second state to monitor for a second one of the sequence of events, wherein the second one of the sequence of events is a next sequential one of the sequence of events associated with malware, 
 the event handler further configured in a final one of the plurality of states to respond to a terminal event in the sequence of events by identifying a compromised computing object causally dependent on the root cause of the malware on the endpoint, and 
 the event handler configured to respond to an exit condition from one or more of the plurality of states by returning to the first state; 
   deploying the event handler on the endpoint for use in identifying the malware in response to detecting the root cause;   monitoring events on the endpoint with the event handler;   detecting the malware on the endpoint based upon a detection of the sequence of events concluding in the terminal event; and   remediating the malware on the endpoint.   
     
     
         2 . The computer program product of  claim 1 , further comprising code embodied in the non-transitory computer readable medium that causes the one or more computing devices to perform the step of creating the sequence of events based on a forward traversal of the event graph. 
     
     
         3 . The computer program product of  claim 1 , further comprising code embodied in the non-transitory computer readable medium that, when executing on the one or more computing devices, causes the one or more computing devices to perform the steps of:
 storing a current one of the plurality of states; and   retrieving an additional state of the plurality of states from a remote threat management facility when the event handler transitions from the current one of the plurality of states based upon the occurrence of a corresponding one of the sequence of events.   
     
     
         4 . The computer program product of  claim 1 , wherein the first state of the event handler is an initial state having a shared scope to prevent multiple threads from launching in response to multiple occurrences of the root cause in the sequence of events. 
     
     
         5 . A method comprising:
 identifying a first event in a sequence of events associated with malware on an endpoint, wherein identifying the first event includes traversing an event graph among a sequence of causal events in reverse chronological order to a root cause of the malware;   configuring an event handler for use with the endpoint,
 the event handler including a first state configured to monitor for an occurrence of the first event in the sequence of events, the first state configured to respond to the occurrence of the first event in the sequence of events by transitioning to a second state, 
 the event handler configured in the second state to monitor for a second one of the sequence of events, 
 wherein the second one of the sequence of events is a next sequential one of the sequence of events associated with malware, 
 the event handler configured to respond to a terminal event in the sequence of events by identifying a compromised computing object causally dependent on the root cause of the malware on the endpoint, and 
 the event handler configured to respond to an exit condition by returning to the first event in the sequence of events; and 
   deploying the event handler on the endpoint for use in identifying the malware.   
     
     
         6 . The method of  claim 5 , further comprising monitoring events on the endpoint with the event handler, and in response to detecting the malware on the endpoint based upon an occurrence of the sequence of events concluding in the terminal event, remediating the malware on the endpoint. 
     
     
         7 . The method of  claim 5 , wherein configuring the event handler includes creating the sequence of events based on a forward traversal of the event graph. 
     
     
         8 . The method of  claim 5 , wherein deploying the event handler includes deploying the event handler in a security agent executing on the endpoint. 
     
     
         9 . The method of  claim 5 , wherein deploying the event handler includes deploying the event handler on a threat management facility, wherein the endpoint is instrumented to communicate event detection information for the sequence of events to the threat management facility. 
     
     
         10 . The method of  claim 5  wherein at least one of the sequence of events includes a multi-parameter event. 
     
     
         11 . The method of  claim 5 , wherein the exit condition includes a time limit for detection of the malware. 
     
     
         12 . The method of  claim 5 , wherein the sequence of events includes at least one event from a computing object selected from a group consisting of a data file, a process, an application, a registry entry, a network address, and a peripheral device. 
     
     
         13 . The method of  claim 5 , wherein the sequence of events includes at least one event from a network address selected from a group consisting of a uniform resource locator (URL), an internet protocol (IP) address, and a domain name. 
     
     
         14 . The method of  claim 5 , wherein the sequence of events includes at least one event from a peripheral device selected from a group including at least one of a universal serial bus (USB) memory, a network interface card, a camera, a printer, a mouse and a keyboard. 
     
     
         15 . The method of  claim 5 , wherein the sequence of events includes at least one file operation selected from a group consisting of a read, a write, an open, a move, a copy and a delete. 
     
     
         16 . The method of  claim 5 , wherein the sequence of events includes at least one inter-process communication selected from a group consisting of a create, a handle, a debug and a remote injection. 
     
     
         17 . A system comprising:
 a threat management facility configured to perform the steps of:
 identifying a first event in a sequence of events associated with malware on an endpoint, wherein identifying the first event includes traversing an event graph among a sequence of causal events in reverse chronological order to a root cause of the malware; 
 configuring an event handler for malware detection on the endpoint based on the sequence of events,
 the event handler including a first state configured to monitor for an occurrence of the first event in the sequence of events, and to respond to the occurrence of the first event in the sequence of events by transitioning to a second state, 
 the event handler configured in the second state to monitor for a second one of the sequence of events, wherein the second one of the sequence of events is a next sequential one of the sequence of events associated with malware, 
 the event handler further configured to respond to a terminal event in the sequence of events by identifying a compromised computing object casually dependent on the root cause of the malware on the endpoint, and 
 the event handler configured to respond to an exit condition from one or more of the sequence of events by returning to the first event in the sequence of events; and 
 
   a local security agent locally executing on the endpoint,
 the local security agent deploying the event handler on the endpoint for use in identifying the malware, 
 the local security agent configured to monitor events on the endpoint with the event handler, and 
 the local security agent configured to, in response to detecting the malware on the endpoint based upon an occurrence of the terminal event in the sequence of events, initiate remediation of the malware on the endpoint. 
   
     
     
         18 . The system of  claim 17 , wherein configuring the event handler for malware detection includes creating the sequence of events based on a forward traversal of the event graph. 
     
     
         19 . The system of  claim 17 , wherein the exit condition includes a time limit for detection of the malware. 
     
     
         20 . The system of  claim 17 , wherein the sequence of events includes an event from at least one of a computing object, a network address, a peripheral device, a file operation, and an inter-process communication.