Control flow integrity monitoring for applications running on platforms

Abstract

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on observing and generating a control flow directed graph. The techniques and systems include determining an observation phase for a process or application on a computing device. During the observation phase, CPU telemetry is determined and used to generate a control flow directed graph. After the control flow directed graph is generated, a monitoring phase may be entered where transfers of instruction pointers are monitored based on the control flow directed graph to identify invalid transfers. Transition to the monitoring phase may be based on determining a confidence score in the observed control flow directed graph and causing the transition when the confidence score is above a threshold.

What is claimed is: 
     
         1 . A method for monitoring a computing system, comprising:
 determining an observation phase for observing execution of processes on the computing system;   determining telemetry, during the observation phase, representing execution of the processes;   generating a control flow directed graph representing execution sequences of an application based on the telemetry;   determining a confidence score associated with the control flow directed graph;   determining a monitoring phase based at least in part on the control flow directed graph and the confidence score;   monitoring transfers of instruction pointers at the computing system; and   determining an invalid transfer based at least in part on the control flow directed graph.   
     
     
         2 . The method of  claim 1 , wherein determining the confidence score comprises determining a proportion of the processes represented in the control flow directed graph and wherein determining the monitoring phase is in response to the confidence score being above a threshold. 
     
     
         3 . The method of  claim 1 , wherein generating the control flow directed graph is based on observed transfers during the observation phase, wherein the observed transfers during the observation phase are considered valid transfers. 
     
     
         4 . The method of  claim 1 , wherein determining the telemetry, during the observation phase, comprises:
 dividing underlying code associated with the processes into a plurality of workloads;   assigning the plurality of workloads to two or more computing devices associated with the computing system for observation; and   aggregating observation data from the two or more computing devices, the observation data representing the telemetry.   
     
     
         5 . The method of  claim 1 , wherein determining the confidence score comprises:
 determining a first threshold for the confidence score, wherein the first threshold is used for determining the monitoring phase; and   determining a second threshold for the confidence score, the second threshold lower than the first threshold, wherein the second threshold is based at least in part on receiving one or more policy allowance conditions associated with determining the monitoring phase.   
     
     
         6 . The method of  claim 1 , wherein the telemetry comprises central processing unit (CPU) telemetry, and wherein generating the control flow directed graph comprises normalizing the CPU telemetry into a control flow directed graph representation. 
     
     
         7 . The method of  claim 6 , wherein the monitoring phase is performed using a hardware device of the computing system and wherein determining the invalid transfer is based at least in part on identifying an instruction sequence in the CPU telemetry that is not present in the control flow directed graph. 
     
     
         8 . A system comprising:
 one or more processors; and   one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
 determining an observation phase for observing execution of processes by the one or more processors; 
 determining telemetry, during the observation phase, representing execution of the processes; 
 generating a control flow directed graph representing execution sequences of an application based on the telemetry; 
 determining a confidence score associated with the control flow directed graph; 
 determining a monitoring phase based at least in part on the control flow directed graph and the confidence score; 
 monitoring transfers of instruction pointers by the one or more processors; and 
 determining an invalid transfer based at least in part on the control flow directed graph and the transfers of instruction pointers. 
   
     
     
         9 . The system of  claim 8 , wherein determining the confidence score comprises determining a proportion of the processes represented in the control flow directed graph and wherein determining the monitoring phase is in response to the confidence score being above a threshold. 
     
     
         10 . The system of  claim 8 , wherein determining the telemetry, during the observation phase, comprises:
 dividing underlying code associated with the processes into a plurality of workloads;   assigning the plurality of workloads to two or more computing devices associated with the system for observation; and   aggregating observation data from the two or more computing devices, the observation data representing the telemetry.   
     
     
         11 . The system of  claim 8 , wherein generating the control flow directed graph is based on observed transfers during the observation phase, wherein the observed transfers during the observation phase are considered valid transfers. 
     
     
         12 . The system of  claim 8 , wherein determining the confidence score comprises:
 determining a first threshold for the confidence score, wherein the first threshold is used for determining the monitoring phase; and   determining a second threshold for the confidence score, the second threshold lower than the first threshold, wherein the second threshold is based at least in part on receiving one or more policy allowance conditions associated with determining the monitoring phase.   
     
     
         13 . The system of  claim 8 , wherein the one or more processors comprise one or more processors across organizational boundaries. 
     
     
         14 . The system of  claim 13 , wherein determining the telemetry comprises aggregating observation data from the one or more processors, the observation data representing the telemetry. 
     
     
         15 . One or more non-transitory computer-readable media storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to:
 determine an observation phase for observing execution of processes by the one or more processors;   determine telemetry, during the observation phase, representing execution of the processes;   generate a control flow directed graph representing execution sequences of an application based on the telemetry;   determine a score associated with the control flow directed graph; and   convey the control flow directed graph to a computing device for monitoring execution of processes by the computing device based at least in part on the control flow directed graph and in response to the score being above a threshold.   
     
     
         16 . The one or more non-transitory computer-readable media of  claim 15 , wherein the instructions to generate the control flow directed graph comprise further instructions to determine completion of the observation phase based at least in part on the control flow directed graph representing at least a threshold portion of application processes. 
     
     
         17 . The one or more non-transitory computer-readable media of  claim 15 , wherein determining the score comprises:
 determining a first threshold for the score, wherein the first threshold is used for determining to convey the control flow directed graph; and   determining a second threshold for the score, the second threshold lower than the first threshold, wherein the second threshold is based at least in part on receiving one or more policy allowance conditions associated with the control flow directed graph.   
     
     
         18 . The one or more non-transitory computer-readable media of  claim 15 , wherein determining the telemetry comprises:
 dividing underlying code associated with the processes into a plurality of workloads;   assigning the plurality of workloads to two or more computing devices associated with the one or more processors for observation; and   aggregating observation data from the two or more computing devices, the observation data representing the telemetry.   
     
     
         19 . The one or more non-transitory computer-readable media of  claim 15 , wherein determining the score comprises determining a proportion of the processes represented in the control flow directed graph and wherein conveying the control flow directed graph is in response to the score being above a threshold. 
     
     
         20 . The one or more non-transitory computer-readable media of  claim 15 , wherein:
 the one or more processors comprise one or more processors across organizational boundaries; and   determining the telemetry comprises aggregating observation data from the one or more processors, the observation data representing the telemetry.