BACKGROUND

Field of the Various Embodiments

Embodiments relate generally to computer science and digital forensic science and, more specifically, to a differencing engine for digital forensics.

Description of the Related Art

When a security attack is detected in a computing environment that includes multiple host instances computers, servers, cloud instances, virtual machines, etc.), determining which host instances have been compromised is critical to being able to mitigate any damage arising from the attack. For example, if an identity-theft malware attack were to successfully target a cloud-based online marketplace, then the users of the online marketplace would be at risk until all compromised host instances implemented in the online marketplace could be identified and the injected malware could be completely eradicated.

One way to identify compromised host instances is for a security team to manually inspect every host instance for signs of an attack or an attacker. In such an approach, upon identifying signs of an attack or an attacker in one of the host instances, the security team manually inspects the other host instances to identify additional host instances that exhibit the identified signs. While inspecting the various host instances for the identified signs, the security team may discover additional signs of the attack or attacker. In such situations, the security team also has to inspect different host instances to identify any host instances that exhibit the additional signs of the attack or attacker. The security team manually inspects host instances in this type of iterative fashion until the security team is unable to detect any additional signs of the attack or attacker. One drawback of this type of iterative inspection process is that, when the number of host instances requiring inspection is relatively large (e.g., 300), identifying compromised host instances can take several hours or even days. During a prolonged inspection process, an attack or attacker is usually able to continue stealing information, hurting business operations, damaging software, etc.

To reduce the time required to detect compromised host instances, a file integrity monitoring application can be preemptively deployed to each host instance in a given computing environment. In operation, the typical file integrity monitoring application compares the current state of a given host instance to a previously-captured and known “good” state for that host instance and issues an alert when a mismatch is detected between the two states. One drawback of file integrity monitoring applications is that the evaluation mechanism implemented in such applications is relatively inflexible. In particular, file integrity monitoring applications require foreknowledge of each host instance (e.g., a known good state). As a result, file integrity monitoring applications typically require extensive tuning and continued maintenance to effectively detect compromised host instances.

As the foregoing illustrates, what is needed in the art are more effective techniques for analyzing host instances in computing environments in order to mitigate security attacks.

SUMMARY

One embodiment sets forth a method for analyzing one or more host instances in a computing environment in order to mitigate a security attack. The method includes acquiring a first set of snapshots for a first instance group, where each snapshot represents a current operational state of a different host instance included in the first instance group; performing one or more clustering operations based on the first set of snapshots to generate a first set of clusters; and determining that a first host instance included in the first instance group is operating in an anomalous fashion based on a first cluster included in the first set of clusters that is associated with fewer host instances than at least a second cluster included in the first set of clusters.

At least one technical advantage of the disclosed techniques relative to the prior art is that, with the disclosed techniques, host instances exhibiting anomalous security-relevant behavior can be more efficiently and effectively identified. In that regard, because the disclosed techniques enable snapshots of the host instances to be automatically collected and evaluated to identify anomalies, the time required to identify compromised host instances can be reduced relative to prior art approaches. Reducing the time required to identify host instances that are compromised during a security attack typically can reduce the amount of damage caused by the attack. Further, unlike some prior art approaches, the queries used to generate the snapshots can be flexibly modified during a security attack to increase the effectiveness of detecting compromised host instances. These technical advantages represent one or more technological advancements over prior art approaches.

