University of South Florida

Santosh K Aditham

Nagarajan Ranganathan

A runtime attack can be detected on a big data system while processes are executed on various nodes. A behavior profile can be maintained for tasks or processes running on different nodes. The existence of a call variance in one of the traces for one of the behavior profiles can be determined. A memory variance can also be detected in one of the behavior profiles. A runtime attack has occurred when both the memory variance and the call variance are determined to exist.

Detecting threats in big data platforms based on call trace and memory access patterns

Various examples of methods and systems are provided for an attack detection system that can detect attacks in big data systems. The attack detection system can include security modules coupled to data nodes of the big data system. The attack detection system can identify a process executing on the respective data node. A process signature can be generated for the process executing on the data node. A determination of whether a big data system is being attacked can be based at least in part on a comparison of the process signature with at least one other process signature for the same process executing on another security module. The other process signatures are received via secure communication from the other security module.

Systems and methods for detecting attacks in big data systems

A runtime attack can be detected on a big data system while processes are executed on various computing devices. A behavior profile can be maintained for tasks or processes running on different computing devices. The existence of a call variance in one of the traces for one of the behavior profiles can be determined. A memory variance can also be detected in one of the behavior profiles. A runtime attack has occurred when both the memory variance and the call variance are determined to exist.

Growing community of inventors

Mountain View, CA, United States of America

Santosh K Aditham