Event-based attack detection

摘要

Event-based attack detection is described. In some implementations, an attack on a computing device can be detected by identifying unusual events, or unusual sequences of events, that occurred on the computing device. A computing device can log events that occur on the computing device. In some implementations, the unusualness of an event, or sequence of events, on the computing device can be determined based on a comparison of events logged by the computing device and events logged by other computing devices. Other implementations are described.

主权项

1. A method comprising:
accessing, by one or more computers, information about event logs that correspond to the event logs of a particular computing device and one or more computing devices; identifying a particular event from the accessed information; determining a hash value of a file or a process associated with the particular event; comparing the determined hash value with an expected hash value for the file or the process; comparing, by one or more computers, the accessed information for the particular event from the particular computing device with the accessed information for the particular event from the one or more computing devices; determining that the particular event is an unusual event based on results of comparing the accessed information for the particular event from the particular computing device with the accessed information for the particular event from the one or more computing devices and of comparing the determined hash value with an expected hash value for the file or the process; accessing, from a database, one or more risk factors for a malware attack on a computing device; comparing the unusual event against the accessed risk factors; determining, based on results of comparing the unusual event against the accessed risk factors, whether the unusual event satisfies at least one of the risk factors; and verifying whether the unusual event is the malware attack when at least one of the risk factors is satisfied.