Anti-malware behavior graph engine, system, and method

Abstract

The method and system are operable to protect a computing environment from attacks, incorporating preventative capabilities with attributes similar to anti-virus / anti-malware techniques suitable for use in home users or similar protected computing environments where centralized human administrative resources are absent or minimal using natural language.

Description

[Technical Field]

[0001] cross reference This application claims priority to U.S. Utility Patent Application No. 18 / 366,886, filed August 8, 2023, which claims the benefit of U.S. Provisional Application No. 63 / 371,551, entitled "ANTI-MALWARE BEHAVIORAL GRAPH ENGINES, SYSTEMS AND METHODS," filed August 16, 2022, and U.S. Provisional Application No. 63 / 491,789, entitled "ANTI-MALWARE BEHAVIORAL GRAPH ENGINES, SYSTEMS AND METHODS," filed March 23, 2023, each of which is incorporated by reference in its entirety.

[0002] Copyright Notice A portion of the disclosure of this patent specification contains material that is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction of the patent disclosure as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever. [Background technology]

[0003] In the field of computer security, unauthorized use of computing resources, unauthorized access to data, or unauthorized modification of data is called an "attack." A system or networked communication path between systems over which an authorized owner desires to maintain authorization control is referred to herein as a "protected computing environment." A person, software, or organization that launches an "attack" against a "protected computing environment" is referred to as an "attacker." A person, software, or organization that defends a protected computing environment from attacks and attackers is referred to as a "defender." A protected computing environment may have one or more authorized users, and a defender may be an authorized user, but may also be a separate entity from the set of authorized users. An attacker is an unauthorized user of resources within a protected computing environment if they gain access to those resources.

[0004] Defenders have two basic approaches to protecting computing environments from attacks and attackers. The first basic approach to protecting computing environments focuses on detecting "malicious" compiled or scripted programs and preventing their execution, or mitigating the effects of their execution through additional security controls that can be applied in real time or after the fact. Techniques for detecting such malicious applications include the following:

[0005] Creating a baseline of allowed applications or network communications and only allowing explicitly allowed programs to run (often called "application control" or by the archaic term "whitelisting") or network communications to occur (often called "firewalling").

[0006] Performing analysis of compiled or scripted programs to attempt to predetermine the effects of their execution before the fact (often called anti-virus or anti-malware scanning).

[0007] Calculating the similarity between a compiled or scripted program and known malicious programs (an alternative technique typically deployed by "anti-virus / anti-malware" scans).

[0008] Allowing a suspicious program to run in a temporary computing environment to observe its behavior before allowing it to run in a protected computing environment (often called "detonation" or "sandboxing," or sometimes called "next-generation firewalls"), sometimes combined with other analysis techniques.

[0009] Hashing or other fingerprinting techniques for comparison to lists of known malicious applications (typically deployed by "anti-virus / anti-malware", but alternative techniques also deployed by "reputation services" or "reputation feeds").

[0010] Creating a set of rules or artifacts (such as filenames, domain names, IP addresses, or process names) that, if violated or interacted with, will cause a program to be deemed malicious (often called "host intrusion detection" or "network intrusion detection").

[0011] Antivirus / anti-malware techniques, in particular, are easy to manage and are often deployed in protected computing environments, including computers used for personal use in someone's home. Other techniques, such as application control, Host Intrusion Prevention Systems (HIPS) / Network Intrusion Protection Systems (NIPS), and detonation, often work best in relatively large protected computing environments with some degree of centralized human management. These techniques are most effective overall when an attacker in a protected computing environment uses a single or a few compiled or scripted programs to launch an attack and repeats the same steps across multiple attack victims. Existing techniques are often unable to detect or prevent attacks when attackers change behavior or use authorized programs in unexpected ways, which can defeat application control techniques. An example of using an authorized program in an unexpected way might occur, for example, if there is an authorized utility program that is highly configurable, either through a configuration file or command line parameters, and has the functionality to download updates from the Internet and invoke an update utility to update an authorized application. An attacker could manipulate the command line parameters to download a malicious script and then invoke a command interpreter with the downloaded script. Although the authorized utility provides its functionality, its purpose is subverted from its original creator's intent of updating the application to being used to invoke the malicious script. A particular weakness of this approach is that if an attacker attempts an attack but is rebuffed by some techniques, they can use this knowledge of what mitigation techniques are in place to modify their behavior and attack again until they find a combination that does not prevent those techniques.

[0012] Another approach focuses on monitoring and auditing the behavior of a protected computing environment. This approach does not attempt to prevent malicious programs from executing, but rather allows an operator or automated system to look for patterns of behavior that indicate unauthorized use of the protected computing environment. While reactive, this approach has the advantage of stronger detection than a purely preventative approach in that it focuses on the actual, eventual behavior of programs and network communications within the protected computing environment, without prior knowledge of whether a particular program is malicious or, more seriously, if an attacker in the protected computing environment is using authorized programs in unexpected ways to achieve their attack goals. In particular, this can be used to monitor for repeated attacks and prioritize corrective defenses (such as applying software updates or modifying firewall rules) if the initial attack is repelled. This monitoring approach is often referred to as "Enterprise Detection and Response" (EDR) when focused on computing resources, "Network Detection and Response" (NDR) when focused on networking resources, or "Extended Detection and Response" (XDR) when it is a hybrid of monitoring both computing and networking resources. Some implementations may collect data about the activity of computing and network resources and use a manual or automated search or query process to find patterns of attack (often referred to as "threat hunting"). Such systems may incorporate various automated tools to assist in this process but are most suited to relatively large, protected computing environments, such as those common in large business organizations with some degree of centralized human management.

[0013] Defenders may use aspects of both basic approaches to defend protected computing environments (often referred to as "next-generation antivirus"). However, due to its operational cost and complexity, this approach is most effective in relatively large computing environments with centralized human management.

[0014] What is needed is a method and system for protecting a computing environment from attack that incorporates administratively simple prevention capabilities along with the broad detection capabilities of monitoring and auditing approaches. Additionally, what is needed is a system and mechanism for determining that two events are causally related, and for observing cause-and-effect relationships between entities within a computing system. Summary of the Invention

[0015] The disclosed system for operating an anti-malware behavior graph engine comprises a memory and a processor in operative communication with the memory, the processor providing instructions and data and operable to perform the disclosed steps. The computer-readable storage medium is also configurable and operable with data and programmed instructions to, when executed by the processor, perform the method leading to the disclosed steps. Furthermore, the disclosed method is operable to operate within a computer network and to perform the programmed operations.

[0016] Methods and systems are disclosed for protecting computing environments from attacks that have many of the detection advantages of monitoring and auditing approaches, but incorporate preventative capabilities with attributes similar to anti-virus / anti-malware techniques suitable for use in home user or similar protected computing environments where centralized human administrative resources are absent or minimal.

[0017] Systems and mechanisms for determining that two events are causally related, as well as systems and mechanisms for observing cause and effect relationships between entities within a computing system, are also disclosed.

[0018] The disclosed malware model is operable to detect attacks that may be complex, including multiple stages (e.g., multi-stage attacks) using various techniques as an abstract "attack language" to achieve tactical attack objectives. The use of a conceptual attack model builds on existing work summarized by MITRE's descriptive ATT&CK™ matrix framework, which, while a useful reference, is not exhaustive or complete. The attack language approach can work with or across other descriptive frameworks. In an abstract attack language model, specific techniques used by attackers to conduct attacks are added as members of a language vocabulary. The attack language is semantically structured such that the attack is a semantically complete set of statements describing the activities that must be performed to achieve a tactical or strategic attack objective. Such complete statements can, in principle, be used as input to a high-level scripting environment to reproduce the attack on the same or a different computing environment. From the semantically complete attack sentence, a grammar of the attack language can be derived that comprises a body of rules indicating whether a given sequence of two or more attack words (AWs) represents a grammatically correct attack sentence. A grammatically correct attack sentence represents an attacker's actions that the attacker can perform and that advance the attacker's goals to the extent that they obtain unauthorized use of the protected computing environment.

[0019] The disclosed approach monitors one or more events from a protected computing environment and classifies one or more events that represent specific members of an attack language vocabulary. It is expected that most events in the computing environment will not represent members of the attack language vocabulary, and such events will be excluded from further consideration. By analogy, in a noisy environment where someone is speaking, there may be many sounds present, only some of which are part of human speech, and a listener wishing to hear the conversation must filter out sounds that are not part of human speech. Similarly, classifying an event as a member of the attack language vocabulary is a first step in understanding an attack. There are various methods for selecting events that represent members of the attack language vocabulary, and while many of these methods are important for traditional HIPS, EDR, NDR, and XDR solutions, some are more suitable for real-time evaluation of events.

[0020] The disclosed approach automates the discovery of abstract attack language grammatical relationships between members of a vocabulary. The approach builds a conceptual graph representing an attack language sentence. Nodes are added to this graph using information derived from a model of causal relationships within a given operating system or network. Using the causal model increases confidence that two words in the attack language vocabulary are causally related to each other. By analogy, the causal model is like picking out words spoken by individual speakers in a crowded room; simply detecting words spoken across the entire room is unlikely to result in a coherent sentence. At that point, the derived grammar rules around the attack language can be applied to determine whether a grammatically correct sentence is formed. If not, the newly discovered attack word does not represent attacker behavior and can be ignored.

[0021] The graph representation of the attack sentence can be used to build a model for predicting the next attack word, the part of the attack sentence that is being formed, and / or the next attack sentence. The method allows for defining a confidence threshold based on observed attack words that indicates the semantically complete attack language or attack sentence that is being formed. This information can be used to stop the attack.

[0022] These systems and methods are configurable and operable to stop attacks by directly correcting underlying events labeled as representing the next attack word, such as preventing an operation, modifying data, or terminating a process. The graph representation can also be used to "walk backwards" using the graph as a source of provident information, as the graph is populated using a causal model. Further remediation actions can then be taken based on previous events, such as deleting or repairing malicious or infected files, removing configuration changes, quarantining scheduled tasks and services that the attacker may have created, or quarantining entire elements of the computing environment.

[0023] The disclosed systems and methods are also configurable and operable to capture events from various sources within the overall protected computing environment, including from the device operating system, device-local social media applications, or cloud-hosted social media applications. As will be appreciated by those skilled in the art, cloud-hosted social media applications include any and all of the various ways in which users interact with other users in a computing environment or metaverse. Social media applications include, but are not limited to, Facebook, LinkedIn, X (formerly Twitter), MS Teams, Slack, Discord, online games, and other social interactions, including Gmail, Google Docs, GitHub, and the like. Using one or more classification engines, these systems and methods determine whether a given event or sequence of events from an event source represents a word within a defined vocabulary of attack words. Furthermore, events are maintained in a directed graph data structure in which links are created between graph nodes and subjects according to domain-specific causality rules, and are classified as attack words. Events occurring within the cloud-hosted social media application are associated with events occurring as responses on the protected device or another social media application. A natural language machine learning model is used to determine whether a provenance path through the directed graph store of the detected attack words represents a semantically meaningful attack sentence. Taking remediation action occurs upon detecting the semantically meaningful attack sentence. A natural language machine learning model can be used to determine whether a providence path through the graph of the detected attack words represents a semantically meaningful attack sentence fragment and predict the next possible attack word to complete the sentence. Based on the predicted next attack word in the attack sentence, a bounded remediation action can be taken.By using the overall topology of the attack sentence graph, these systems and methods can establish general identities for both authorized user entities and attacker entities. Furthermore, the overall topology of the attack sentence graph is used to establish specific identities for individual user entities and attacker entities. Furthermore, the identities of normal user entities and attacker entities are used to feed back into natural language model training as labeled sets representing both general "authorized user / attacker" behavior and specific "authorized user / attacker" entity behavior.

[0024] One way to curate a dataset is to develop a sufficient number of attack word labeling rules, acquire a malware corpus, build a test lab, and detonate malware used by attackers in the early stages of an attack in a lab environment while running agents on the system to collect the corresponding attack word graphs. The problem with this approach is that it is time-consuming, requires significant engineering and financial resources, and very often the malware for a complex campaign must be able to communicate with its command and control center in order to operate.

[0025] An alternative approach is to utilize existing large-scale language models (LLMs), such as OpenAI's Generative Predicting Transformer (GPT) or Meta's Large Language Model Meta AI (LLaMA), which can be fine-tuned through transfer learning to synthesize attack word graphs from raw bodies of free text, which can be obtained from public or private information security threat reports describing attack campaigns.

[0026] Both the foregoing summary and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosed embodiments, as claimed.

[0027] All publications, patents, and patent applications mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent, or patent application was specifically and individually indicated to be incorporated by reference. [Prior art documents] [Non-patent literature]

[0028] [Non-Patent Document 1] Available from: https: / / arxiv.org / abs / 2104.09806 (April 20, 2021) WEI, et al., DeepHunter: A Graph Neural Network Based Approach for Robust Cyber ​​Threat Hunting [Non-patent document 2] HASSAN, et al., Tactical Provenance Analysis for Endpoint Detection and Response Systems, available online at https: / / adambates.org / publications / (May 18, 2020). [Non-patent document 3] BENGIO et al., A Neural Probabilistic Language Model 2003, Journal of Machine Learning Research 3(2003), available at https: / / www.jmlr.org / papers / volume3 / bengio03a / bengio03a.pdf [Non-patent document 4] Available on the Internet at https: / / arxiv.org / abs / 1706.03762 (June 12, 2017) VASWANI et al., Attention Is All You Need

[0029] The novel features of the invention are set forth with particularity in the appended claims. A better understanding of the features and advantages of the present invention will be obtained by reference to the following detailed description that sets forth illustrative embodiments, in which the principles of the invention are utilized, and the accompanying drawings. [Brief explanation of the drawings]

[0030] [Figure 1] FIG. 1 illustrates an architecture with multiple users, a collection of protected devices, various attack vectors to be protected against (even up to social media), and a backend responsible for configuring the devices to protect and collect telemetry. [Figure 2A] FIG. 1 illustrates abstract events in an attack graph. [Figure 2B] FIG. 1 illustrates that attack words (AW) are a subset of possible events. [Figure 3] FIG. 1 illustrates the functional relationships between the different modules that comprise a behavioral anti-malware engine running on a protected device. [Figure 4] FIG. 2 is a high-level diagram of the steps involved in filtering events. [Figure 5] FIG. 1 illustrates the event steps in the classification process. [Figure 6] FIG. 1 illustrates the processing of a time-ordered sequence of events originating from the same initiator (process). [Figure 7] FIG. 1 illustrates a classification of attack graphs. [Figure 8] 1 shows two attack graphs with the same number of nodes / AW, but where valid attack statements are classified as valid attack statements, while invalid attack statements are not classified. [Figure 9]FIG. 1 illustrates how the graph is expanded and the causal relationships between different actors. [Figure 10] FIG. 1 illustrates establishing user and attacker identities based on the overall attack graph state. [Figure 11] FIG. 10 illustrates how the behavioral anti-malware engine works with a stream of events from multiple subjects with different results shown. [Figure 12] FIG. 1 illustrates how a behavioral anti-malware engine works with streams of events from multiple actors and attack statement models to create graph links between causal gaps. [Figure 13A] FIG. 1 illustrates how a large-scale language model (LLM) is fine-tuned on a bootstrap dataset of (prompt, attack word) pairs to generate words that belong exclusively to the attack vocabulary. [Figure 13B] FIG. 1 illustrates how the entire corpus of attack sentences is obtained using a fine-tuned LLM and a corpus of natural language information security threat reports. [Figure 14] FIG. 1 illustrates how an attack word prediction model is trained that also generates embedding vectors. [Figure 15A] FIG. 1 illustrates exemplary software code. [Figure 15B] FIG. 1 illustrates exemplary software code. [Figure 15C] FIG. 1 illustrates exemplary software code. DETAILED DESCRIPTION OF THE INVENTION

[0031] The systems and methods can be configured to use cloud-hosted applications, e.g., applications that run in a client-server manner across a network, with much of the application residing in a public or private cloud and a subset of the application logic residing or running on the local device. As will be appreciated by those skilled in the art, such cloud-hosted applications may exist as standalone "apps" on the local device or may be accessed through a general-purpose application such as a web browser. In context, social media applications are applications that are primarily cloud-hosted and may exist for the exchange of media and information between multiple user entities, where user entities may provide media or information to other users in some manner, with or without moderation. The information may include behavioral information. Social network applications may also be used interchangeably with social media in the description. Social network applications include, but are not limited to, Twitter, Twitch, Facebook, YouTube, Discord, and Instagram.

[0032] 1 illustrates an architecture having multiple users 101 and a collection of protected computing devices 102, each representing a protected computing environment. As will be appreciated by those skilled in the art, a computing environment may be subject to methods (e.g., attack vectors) for gaining unauthorized access to a network or computer system, and an attack surface is the total number of attack vectors that an attacker can use to manipulate or extract data from a network or computer system.

[0033] Each user 101 may have one or more protected devices within the protected computing environment or may share devices within the protected computing environment with other users, and the protected computing environment may even include computing resources not directly owned by the user, such as those implementing cloud-hosted applications for which the user has an account, and various attack vectors 104 are monitored, including low-level network data and higher-level application data, such as device-local or cloud-hosted social media applications, and a management backend 106 responsible for configuring the devices to protect and collect telemetry, connected via one or more public or private networks 108. Attack vectors 105 are monitored by various methods, including direct inspection of data sent to the protected device 102 across the network 108, either before or as part of the networking stack of the operating system of the protected computing device 102, or as an indirect artifact, such as a downloaded file, which, when evaluated, edited, or executed by the user 101 or the operating system of the protected computing device 102, results in an operating system event. Indirect operating system events may also arise from network data residing in the protected device's memory or other forms of temporary or persistent storage. Attack vectors 105 may include social media applications and may be monitored within a social media application running on the device, or hosted within another application such as a web browser, or hosted using a cloud-hosted Application Programming Interface (API) directly from the protected computing device 102 or from a management backend 106.

[0034] FIG. 2A illustrates an abstract event 151, including actors representing roles within an attack graph 150, a model-based approach for network security analysis. In some situations, the event is composed of at least a triplet of entities, including an initiating actor 152, an action actor 153, and a target actor 154 within the event 151. Collectively, the abstract event 151 describes one or more attack activities that are altering the overall state of the protected computing system in some way, even if the changes achieved are trivial. An example of a trivial change might be, for example, changing the last-modified timestamp on a file. Such a timestamp is advisory only, can be easily modified by any application, does not change the operational behavior of most applications, and the change itself is easily undone. An example of a significant change might be the modification or deletion of application data. Such a change is likely to cause the application to function incorrectly or as intended, is more difficult to undo, and may require the use of a backup data source to restore the modified or deleted data to some previous version of that data. Entity attributes include data and metadata about the entity 157. A collection of attributes 156 for an entity 157 is called a subject 155. Each subject 155 (initiating subject 152, action subject 153, and target subject 154) has a collection of attributes 156 for the entity 157.

[0035] The initiating subject 152 is the entity 157 that directly causes the event or requests that the event occur. The action subject 153 is another entity that may have or be able to change the state of the protected computing environment that the initiating subject 152 is attempting to take. The entity 154 targeted by the action subject 153 is a third entity. The target subject 154 is not necessarily the entity that is changed by the event, although target subject 154 is frequently changed by event 151. The changed entity can be either the initiating subject 152 or the target subject 154, or potentially another entity in the protected computing environment that is not part of the triplet of entities in event 151.

[0036] The entities represented by initiating subject 152 and target subject 153 can be different entities, but they can also be the same entity. When represented as a subject, an entity can have different attributes depending on its role in the event as either initiating subject 152 or target subject 154.

[0037] Initiating subject 152 and target subject 154 may have different underlying object types. For example, event 151 describing a file-opening process has the process object as the initiating subject, the file-opening action as the action subject 153, and the file being opened as the target subject. Subjects may also exist outside the protected computing device and represent attack vectors 105, such as a user on a social network or a computer on network 108. While event 151 includes at least these three subjects, initiating subject and target subject can appear in multiple events over time or even simultaneously, while action subject 153 is unique to each event. Event 151 may have additional entities that represent a hierarchical relationship to one of initiating subject 152 or target subject 154, such as protected computing device 102, user 101, or network 108.

[0038] Individual subjects (e.g., initiating subject 152, action subject 153, and target subject 154) or a subset of subject attributes may be stored in directed graph store 218 with edge connections between any of the individual subjects and node property labels for the individual subject attributes. Similarly, entire events may be stored in directed graph store 218 along with causal relationships between the event 151 and node property labels for key elements of the subject attributes.

[0039] 2B illustrates the relationship between an attack word vocabulary 176, which includes individual attack words AW1-AWn 178, where n is the attack vocabulary size for the possible events 174. The attack word vocabulary 176 is a subset of the possible events 174. Essentially, attack words correspond to events 151 or individual event sequences, but are members of the subset that makes up the attack word vocabulary 176. Note that this AWn tagging scheme is used to illustrate the attack word concept. As will be appreciated by those skilled in the art, many tagging schemes exist and / or can be used without departing from the scope of this disclosure.

[0040] It is possible that multiple types of events or event sequences may represent the same attack word. Attack words are more abstract representations of tactical actions an attacker may be taking than specific events classified as attack words. The exact vocabulary of attack words is not static and may change over time as new attack words are added when new attack words are observed being used by attackers and old attack words are retired when old attack words are no longer being used by attackers. An example of an attack word may be an event having a process start executing a file from a system's temporary directory. This event may be classified as an attack word in the attack word vocabulary as AW70. Another event may be a process start executing a file from a user's temporary directory. This event may also be classified as an attack word in the attack word vocabulary as AW70. Both events describe unique behaviors, but both describe the general behavior assigned to AW70 for the example of executing a file from a temporary location.

[0041] 3 illustrates functional relationships among different modules 200, including a behavioral anti-malware engine 201, executing on a protected computing device within a protected computing environment. The functional relationships provide a system for operating an anti-malware behavioral graph engine, the system comprising a memory and a processor in operative communication with the memory, the processor operable to provide instructions and data and perform steps including: developing a model from an attack language including two or more attack words, the model operable to detect at least one of a combined attack and a multi-stage attack; semantically completing the attack language to describe one or more attack activities; predicting one or more tactical attack objectives and strategic attack objectives from the semantically completed attack language; using the semantically completed attack language as input to a high-level scripting environment to reconstruct the attack against the computing environment; and determining a causal relationship between two or more events to provide behavioral information. A computer-readable storage medium configured with data and programmed instructions may also be utilized that, when executed by the processor, performs a method for detecting malware within a computer network.

[0042] A protected device comprises hardware resources 226, a device operating system 208 that manages the device hardware resources 226, including input / output (I / O) devices 204, and network interface devices that connect the protected device to a public or private network 228. In some manner, the device operating system 208 creates an abstraction called a user process 206 that represents some amount of the managed hardware resources 226 with which a user 202 can interact via the I / O devices 204. Many operating systems support multiple concurrent processes and can support multiple simultaneous or consecutive user entities 202. The behavioral anti-malware engine 200 comprises modules that monitor or actively filter hardware and abstract process resource usage, interfaces with device-local or cloud-hosted application APIs, and on-device or on-network monitoring of network traffic to generate potential events 174; an event classification engine 212 that processes events against a corpus of rules to invoke a reaction module 224 and / or classify events 214 as being or not being members of an attack word vocabulary 176; and a behavioral graph engine 216 that evaluates how to store classified events 214 in a directed graph store 218 based on the attack word classification (or lack thereof) of the classified events 214. From the directed graph store 218, a graph of the associated classified events 220 can be found, which is further processed by a graph classification engine 222 to determine the appropriate mitigation reaction module 224 to invoke. The reaction module 224 may include direct modification of the event 210, causing the operating system, a local application, or a cloud application to allow or disallow an action, change the target subject of the event, or remove / modify one or more entities from the event (such as terminating a process, deleting a file, or removing a malware infection from a file).The specific steps performed by each module are further described in FIG.

[0043] Figure 4 is a high-level diagram of filtering steps 300 associated with filtering events 210 from the protected device described in Figure 3 within the behavioral anti-malware engine described in Figure 3. The disclosed process may be part of a system for classifying events for an anti-malware behavior graph engine, the system comprising a memory and a processor in operative communication with the memory, the processor operable to provide instructions and data to perform steps including classifying the event, determining whether the classified event is an attack word, where if the classified event is not an attack word, ignoring the event, and if the classified event is an attack word, tentatively adding the event to an attack graph, determining whether an attack word is an attack word, classifying the attack graph, and determining whether the attack graph is a valid attack statement, where if the attack graph is not an attack statement, ignoring the event, and if the attack graph is an attack statement, committing the event to the attack graph, determining whether a valid attack statement is a valid attack statement, and if the event is not ignored, blocking or terminating the malware process tree to provide behavioral information. Computer-readable storage media configured with data and programmed instructions that, when executed by a processor, perform a method for detecting malware may also be utilized.

[0044] The event is classified (304) to provide an output of classified event 214; the event classification step is described in more detail in FIG. 5. Next, the system makes a determination (306) whether the event is an attack word 178 by determining whether the classified event 214 is recognized as an attack word 178. The attack word is then tentatively added to the attack graph (310), or the event is discarded by ignoring the event (308). After tentatively adding to the attack graph (310), the attack graph is classified (312). Once the attack graph is classified, a determination (314) is made to determine whether the attack graph is a valid attack statement by determining whether the tentative graph forms a coherent attack statement or forms a prefix fragment of a coherent attack statement. If the graph is not a valid attack statement (if no), the event is ignored (308). If the attack graph is a valid attack statement (if yes), the event is committed to the attack graph (315). Once an event is committed to the attack, the malware process tree is blocked or terminated (316).

[0045] The block or terminate process (316) is a remediation step that can include terminating the process, terminating the process tree starting from the subject, and / or quarantining the process's image file in the case of a process entity, or possibly banning or blocking the user in the case of a social media entity. If the expanded graph is recognized as a prefix fragment of a coherent attack statement by the determination step 314 in the block or terminate step (316), the classification engine can predict the next possible attack word in the classification step 312, and a remediation step is performed that includes placing restriction or sandboxing rules for the subject in the attack statement that prevent the predicted next attack word from affecting the protected computing environment, while other entities that do not share the same attack graph (such as other processes or users in a social media application) are not restricted by these prediction rules. Examples can include preventing a process with an attack statement fragment from executing a file from the system's temporary directory but not restricting other processes from doing so, or blocking direct messages containing URL links from a specific social media user but allowing other users to send direct messages containing such URL links.

[0046] Figure 5 provides further details regarding the event classification step (304) of Figure 4, which uses the event 210 to create a classified event 214. During classification of an event 400, the event 210 is checked against one or more classification engines, which may include one or more prepared attack words 178. The classification rules 404 are developed by a threat team and a machine learning (ML) model classification engine 406, which is trained to recognize significant events, particularly those coming from social media vectors, and perform real-time checks against a threat intelligence feed classification engine 408 operable to process one or more threat intelligence feeds. Additionally, feed checks are performed against a user-flagged attack vector classification engine 410. Checks may include malicious websites, social media agents, computer media, etc., and users are given the opportunity to voice their opinions regarding content or behavior they see or perceive via a user interface. Other classification engines may also be present but are omitted from this figure. The classification engine can invoke a reaction module 224 and / or apply zero, one, or more attack word 178 (e.g., AW1-AWn) classification tags to the output classified event 214. Multiple events can constitute an attack word, and such classification requires maintaining state within one or more of the entities; the classified event 214 can be classified using multiple AW1-AWn 178 tags from one or more of the classification rules 404, ML model classification engine 406, threat intelligence feed classification engine 408, and user-flagged attack vector classification engine 410 in step 304 of FIG.

[0047] FIG. 6 illustrates the processing of a time-ordered sequence of events 210 resulting from a process to form an attack graph 506, equivalent to either the provisionally adding events to the attack graph step (310) in FIG. 4 or the committing events to the attack graph step (316) in FIG. 4. Classified events 214 classified as attack words AW1-AWn178 in step 304 in FIG. 4 are added to the attack graph 506 belonging to the initiating entity, while classified events 214 not classified as AW1-AWn178 are ignored. While events tagged AW1-AWn178 can logically be associated with a graph that is an attribute of any entity in the event 151, the process and initiating entity are chosen here to illustrate the concept due to the clarity of time-ordered graph construction it provides. Note that AW3 in this figure includes the sequence of events that together constitute the AW3 attack word.

[0048] FIG. 7 illustrates the classification of the attack graph 506. The anti-malware engine 610 works with a vocabulary of attack words. Each AW1 through AWn178 is represented as an embedding in an attack word embedding vector 603 of length L. The higher the dimensionality of the embedding, the more accurately the relationship between the attack words in the attack sentence is represented. The actual value ranges from 16 to 100. All AWs in the graph are looked up from the attack word embedding vector 603 in step 602. The graph is represented using an MxL two-dimensional matrix 604, where M is the number of nodes / AWs in the graph and L is the dimensionality of the embedding vector. The graph can be classified either by prepared attack rules 606 or by an ML model 608, such as a long short-term memory (LSTM) architecture model.

[0049] FIG. 8 shows graphs of a valid attack statement 704 and an invalid attack statement 706, both of which have the same number of nodes / AWs. However, the valid attack statement 704 was classified as a valid attack statement, while the invalid attack statement 706 was not. The valid attack statement 704 is composed of lexically and grammatically correct attack words forming an attack statement. The graph of the invalid attack statement 706 is composed of lexically correct attack words, not grammatically correct attack statements. Invalid graphs such as 706 do not represent attacker behavior and therefore do not need to be stored in the directed graph store. While the valid graph 700 is not guaranteed to be semantically meaningful and represent attack behavior, the decision space for a behavioral anti-malware engine is significantly reduced between false positives and true positives through this evaluation.

[0050] 9 illustrates the causal relationships between different attack word nodes in the directed graph store. Events 151 can represent interactions between entities that influence or direct later actions of a target entity; these are causal relationships because earlier events can influence later events. In addition to attack word classification rules, the classification engine 212 can also use a rule set to detect events that indicate causal relationships between entities, and can be configured to link graph nodes according to the causal relationships established by the events.

[0051] Some causal relationships indicating an event may also be attack words, and the attack graph may also be extended by the same event with labeled events AW1 to AWn178, creating new attack word nodes in the graph; conversely, some causal relationships indicating an event are not classified as attack words and do not extend the graph, but those causal relationships may create new links in the graph between the subject entity and the attack word.

[0052] Some examples of causal relationships are illustrated using process and file entities as examples. A process is created from a file having a name, and then a specific instance of the process is identified with a process ID number (PID). Processes created from the same file will have distinct PID numbers and are distinct entities from the point of creation from other processes created from the same file. Although process and file entities are used herein to demonstrate causal relationships, entities could be social media user entities, device entities, etc.

[0053] In example 802, when a child process (bar.exe / PID24) is created, the parent initiating subject process entity (foo.exe / PID16) already has a graph assigned to it by the steps of Figure 4. The existing graph of the parent initiating subject (foo.exe / PID16) is transferred to the target subject child process (bar.exe / PID24).

[0054] In example 806, the attack graph is transferred from the initiating subject process (bar.exe / PID24) to the target subject file (foo.bar) that it created, which is an example where the target subject is a different entity type than the initiating subject.

[0055] In example 808, the newly created target subject process (foo.bar / PID48) inherits the graphs of both its initiating subject parent (foobar.exe / PID32) and the file representing the main module (foo.bar), and the target subject child process (foo.bar / PID48) now has two attack statement graphs: one from the parent process foobar.exe / PID32 and another from the file foo.bar.

[0056] In example 810, when an initiating subject process (foobar.exe / PID40) opens a handle with modify rights to a target subject process (foo.bar / PID48), the graph of the initiating subject process (foobar.exe / PID40) is transferred to the target subject process (foo.bar / PID48), which now has three attack statement graphs: one from its original parent process subject (bar.exe / PID24), one from its image file (foo.bar), and a third graph from the initiating process (foo.bar / PID48).

[0057] Other causal relationships exist, and the particular causal event is determined by the semantics of the protected device operating system 208, the network, or the device-local or cloud-hosted social media application.

[0058] The resulting directed graph store can be queried from any given entity to discover any attack words that have a providential relationship to that entity (i.e., going back in time) or any attack words that have a causal relationship to that entity (i.e., going forward in time). This querying capability is used to construct specific paths through the graph store, which are evaluated as attack graphs 506, and classify whether those graphs represent valid attack statements, such as the graph of valid attack statements 704.

[0059] 10 illustrates establishing entity identities for two separate entities based on observed attack word-sentence graphs. As shown, the entities can be the identity of a user 101 or an attacker 104, and the identity can be an attack vector based on the overall attack graph state of a given device 902 with non-attacker behavior, a device 904 with attacker behavior, and / or a device 906 with non-attacker and attacker behavior.

[0060] A device 902 with non-attacker behavior has a user 101 and exhibits some “normal” usage patterns described by a collection of attack graphs, which, while valid attack sentences or fragments, are not true positive indicators of an attack. Such sentences represent valid attack sentences 704 that are lexically and grammatically correct, but lack the semantic meaning of an attack. Such sentences still have value in the system, both as general “normal user” behavior and as specific user entities that allow future models to predict both normal and specific user entity identities, and should be used as negative samples to derive more accurate models. While such behavior is depicted using process entities, the behavior could also be social media user entities, and anomalous behavior could indicate a compromised account, such as a user entity suddenly sending messages that do not match that user entity's behavior.

[0061] On a device 904 with attacker behavior, the identity of the attacker 104 can be established by looking at patterns of attack statements across different protected computing devices in the computing environment. These patterns reflect the attacker entity's cognitive approach to accomplishing an attack by abstracting the tools, tactics, and methods used in the attack to the higher-level attack words being used. Such identity can be used with other information to establish correlations between attacks that relate to a given attacker's activity and may use different tools, tactics, and methods. While such behavior is again demonstrated using a process entity on the device, the behavior could also be a social media user entity sending messages intended to compromise a target user entity in some way.

[0062] Given the identification information established by the patterns of 902 and 904, it is possible to identify attack vectors 105 for both the attacker 104 and the user 101 on a device that has both user and attacker behavior 906. While aspects of the attack graph are similar, it is possible to find distinct differences in behavior that can be used to identify the attacker's behavior as a distinct set from the user's behavior. These differences between the user's behavior and the attacker's behavior can be used to attribute the attack to an attacker entity or to detect the attack statement as a true positive attack and strengthen models for mitigating the attack.

[0063] Furthermore, even if the attacker identity is not known generally or specifically, deviations in the overall graph state from normal user identities can be used for anomaly detection, which can indicate new attack behavior.

[0064] Figure 11 illustrates the steps and resulting state of evaluating event streams representing two separate entities through a behavioral anti-malware engine. This diagram shows a different view of the architecture shown in Figure 3 and the process shown in Figure 4. Events are categorized by attack words (AW) and committed to an attack word graph (AW graph) for process identifiers (PIDs).

[0065] The first event 1001 indicates an event classified as AW1 and committed to the AW graph for entity PID1. The second event 1002 indicates an event that is not classified as an attack word and does not represent a causal relationship; this event is discarded. The third event 1003 indicates an event that represents a causal relationship between entity PID1 and entity PID2. As a result, the attack graph from entity PID1 is duplicated to entity PID2. The fourth event 1004 indicates an event classified as AW2 and committed to the AW graph for entity PID1 that extends PID1's graph to two nodes "AW1->AW2," and entity PID2 is not extended in this scenario because the fourth event 1004 occurred chronologically after the third event 1003 in the causal relationship. The fifth event 1005 indicates an event classified as AW2 for entity PID2, which expands PID2's graph to two nodes "AW1->AW3." Since entity PID1 is not a subject in the fifth event 1005, it is not expanded in this scenario. The sixth event 1006 indicates an event that again represents a causal relationship between entity PID1 and entity PID2. As a result, the attack graph from entity PID1 is merged with the graph on entity PID2. The resulting graph for PID2 now includes the nodes "AW1, AW2, AW3." From the graph on PID2, two possible attack statements can now be constructed: "AW1->AW3" and "AW1->AW2." The seventh event 1007 indicates an event classified as AW4 on entity PID2, which expands the graph for PID2, now including the nodes "AW1, AW2, AW3, and AW4." Now, from the graph on PID2, two possible attack sentences can be constructed: "AW1->AW2->AW4" and "AW1->AW3->AW4". In this diagram, the behavior graph engine predicts that the next possible attack word for PID2 is "AW5", and then a rule is added to the event classification engine to react if AW5 is detected from PID2.An eighth event 1008 indicates an event classified as AW0 on entity PID2. This event is added to the interim graph, but the behavior graph engine determines that the interim graph does not represent a coherent attack sentence or sentence fragment, and both the event and the interim graph are dropped. The graph state of entities PID1 and PID2 remains unchanged from before the eighth event 1008. A ninth event 1009 indicates an event classified as AW5 on entity PID2. Due to the rule added as a result of the seventh event 1007, the reaction module processes this event and the event is mitigated as a blocked attack. A tenth event 1010 indicates an event classified as AW6 on entity PID2. The tenth event is added to the graph for PID2, which now includes "AW1, AW2, AW3, AW4, and AW6." The behavior graph engine determines that one or more of the attack statements "AW1-AW2-AW4-AW6" or "AW1-AW3-AW4-AW6" represent a completed attack statement, and the reaction module mitigates the event as a blocked attack.

[0066] 12 illustrates the steps and resulting states of evaluating an event stream representing three distinct entities through a behavioral anti-malware engine, with a particular focus on using an attack language model to predict whether an attack sentence fragment represents a continuation of a previous attack sentence fragment. The event source 208 interacts with the event classification engine 212, and an event is classified (304). It is determined (306) whether the event is an attack word. The behavioral graph engine 216 classifies (312) the attack graph, which is committed (315) to the attack graph.

[0067] Event 1101 indicates an event classified as AW1 and committed to the AW graph for entity PID1. Event 1102 indicates an event representing a causal relationship between entity PID1 and entity PID2. As a result, the attack graph from entity PID1 is duplicated to entity PID2. Event 1103 indicates an event classified as AW2 for entity PID2 that extends PID2's graph to two nodes, "AW1->AW3." Since entity PID1 is not a subject in event 1103, it is not extended in this scenario. Event 1104 indicates an event classified as AW3 and tentatively added to the AW graph for entity PID3. For illustrative purposes, we use an attack language model that predicts the sequence AW1->AW2->AW3 to have a 75% probability, either because AW3 has a low probability of starting an attack statement or because knowledge of the system's causal model indicates that PID3 represents a causal gap. Therefore, we commit the link between AW1 → AW2 and AW3 on entity PID3 and store the probability of this link in the link. Now, from entity PID3, we can traverse back across the causality gap to PID2 and PID1 and establish that AW3 originated in PID1.

[0068] In an attack graph, a causal gap manifests as one or more attack graphs, which are fragments of a complete attack statement. This disclosure shows how an attack natural language processing (NLP) model can be used to fill "causal gaps" in a causal model used to construct the attack graph. The attack language is semantically complete to describe one or more attack activities. When a causal model is used to store links between events labeled in an AW, a confidence value can be associated with the link. If a causal link is due to direct observation, a confidence value can be assigned with a value equal to 100% confidence.

[0069] Often, within an operating system design, an attack graph "fragment" is associated with a specific aspect of the operating system design that causes a causal observability gap, allowing us to know with some confidence that the attack graph fragment is, in fact, a continuation of another attack graph and not the beginning of a new one. A concrete example might take the complete attack language sentence "'Phishing', 'Privilege Escalation', 'Persistence', 'LOL Bin', 'Download malware'." More specifically, using a Windows operating system, a user might open an email attachment believing it is from a colleague (phishing). The attachment might then leverage one of many means to bypass administrative privileges (User Account Control) and gain administrative privileges (privilege escalation). Using administrative privileges, a scheduled task might then be created (persistence), which, when executed at a later point in time, might download a secondary payload from the web using a built-in Windows utility (LOL Bin) and execute the secondary payload with system privileges (download malware).

[0070] The Windows operating system observes the attack fragment, and the confidence value is <%>;“'Phishing' <100> 'Privilege Escalation'” and assigned to each link, respectively, as a continued attack fragment “'Persistence' <100> 'LOL Bin' <100> Both attack fragments provide an API that allows for the observation of "'Download malware'". Both attack fragments have 100% confidence in the causal relationship between the words in the attack fragments. However, directly observing the causal relationship between the AWs "Privilege Escalation" and "Persistence" is not feasible due to the lack of operating system API support for observing that causal relationship. A sufficiently determined programmer might be able to devise a scheme for directly observing this causal relationship, but doing so comes at the cost of time, complexity, and highly likely increased support costs for the resulting solution.

[0071] Instead, the system and method rely on our attack language model to predict that a first attack sentence fragment can likely be completed by a second attack language fragment, and appends <%>;“'Phishing'” to each link. <100> 'Privilege Escalation' <75> 'Persistence' <100> 'LOL Bin' <100> This can result in a completed attack sentence graph with a confidence value assigned to "'Download malware'". Here, for illustrative purposes, the model assigns 75% confidence to the link between "Privilege Escalation" and "Persistence", while the other links are directly observed and therefore 100% confident. From knowledge of the Windows causal model, we can know with confidence that the scheduled task process resulting from the AW "Persistence" starts from the scheduled task service process, and that a causal gap exists between the process that schedules the task and the process that executes it, so we apply the attack sentence model to make this prediction. Therefore, we can infer that all attack graphs that start from the scheduled task service are attack sentence fragments, and we can inspect existing attack graphs and record the probability that one sentence fragment is linked to a new sentence fragment in the graph. Aside from situations where knowledge from operating system-specific causal models can be used to identify causal gaps, knowledge of the word positions of AWs within the attack language grammar or the attack language classification model itself can also be used to identify that certain AWs do not normally initiate valid attack sentences. If the graph starts from AW, where a sentence would not normally start, we can determine whether the graph may continue some previously established attack language sentence fragment. Note that causality has a time order dependency, so we only evaluate attack language sentence graphs that have attack words that occurred in the second attack language fragment before the first event.

[0072] The resulting link probabilities can either be dropped from the graph if they fall below a certain predetermined confidence interval, or can be incorporated into the model itself as a factor in making its predictions about the attack sentence. Furthermore, the system can perform this same inductive evaluation using an attack language model that lacks one or more AW events in the sentence. As with many spoken languages, the meaning of a sentence is derived not only from the literal words but also from the relative positions of words to one another, so even if words are dropped or scrambled, it is still possible to convey meaning. However, scrambled sentences can often take on multiple meanings, and therefore the reliability of the information they convey is reduced when they are distorted.

[0073] As will be appreciated by those skilled in the art, taken to an extreme, a posteriori evaluation using attack language models can be used in systems where the technical capability to implement causal models simply does not exist. Instead, the system may receive a telemetry stream of individual events that can be classified as attack words, and then apply an attack language model to predict causal relationships between the individual attack words.

[0074] One way to curate an attack word dataset is to develop a sufficient number of AW labeling rules, acquire a malware corpus, build a test lab, detonate malware in the lab environment while running an UpSight agent, and collect the corresponding AW graph. An alternative approach is to utilize existing large-scale language models (LLMs), such as OpenAI's Generative Predicting Transformer (GPT) or Meta's Large Language Model Meta AI (LLaMA), which can be fine-tuned through transfer learning to synthesize attack word graphs from raw text bodies. Free text bodies can be obtained from public domain information security threat report articles describing various attack campaigns.

[0075] As shown in Figures 13A and 13B, the process of fine-tuning the LLM 1206 through transfer learning consists of the following: - {prompt:<free form text> ,result:[AW1,AW2,..AWn]}, where - prompt is free text that describes part of the attack - [AW1,AW2,..AWn] is one or more attack words annotated using the Mitre Att&ck matrix As an example, the bootstrap data set may have the following format: {“Prompt”:“The keylogger then records keystrokes in encrypted files”,“Result”:[“T1056”]},…{“Prompt”:“This utility is able to execute complicated WQL queries and WMI methods”,“Result”:[“T1047']} The bootstrap dataset is curated through manual annotation and public domain data collected from the internet. - Select an existing pre-trained LLM model 1204, trained on a large corpus of text collected from the internet - Training is performed on this reduced bootstrap dataset, where the model is expected to output only words from the attack word vocabulary dictated by the bootstrap dataset in order to fine-tune LLM1206.

[0076] Once the model is fine-tuned on the bootstrap dataset, it can begin to convert information security articles from the threat report corpus 1208 into a fine-tuned LLM AW graph 1206, which is further used to train an attack prediction model and provide an attack sentence corpus 1210.

[0077] As disclosed above, attack words are represented using floating-point valued embedding vectors. The length L of the vector is empirically derived after training and evaluating models with different L=8, 10, 16, 24... etc. One way to obtain the embedding matrix is ​​by training a multi-level perceptron (MLP) neural network as shown in FIG. 14. All attack sentences from the attack sentence corpus 1210 are decomposed into attack sequences of length N. The model takes vectors of N causally ordered attack words 1212 and attempts to predict the most likely embedding of the N+1th word 1220. For example, for N=3, [T1566.001 T1059.007 T1105] → T1218.011

[0078] In natural language, the above translates to the following sentence: AW1=T1566.001 means "User downloaded a zip file from a phishing campaign" - AW2=T1059.007 "Javascript file from downloaded zip file is executed" - AW3=T1105 "javascript downloaded IcedID malware file"

[0079] The output of the model should be the most likely one. AW4=T1218.011 is "rundll32.exe attempted to execute the IcedID malware downloaded from the previous step."

[0080] At the start of training, a lookup matrix of size LxV is initialized with random values, where L is the size of a single embedding vector and V is the size of the attack word vocabulary. All attack words are mapped to columns of this matrix. An attack word sequence of length N is mapped through a matrix 1216 of size LxN, where N is the length of the input sequence. During training, the parameters of the embedding matrix and the attack word prediction model 1218 are optimized based on the calculated loss function. Once the attack word prediction model 1218 is trained, the LxV input matrix represents the attack word embeddings 1214 across the entire attack vocabulary.

[0081] NLP model for predicting the next attack word

[0082] Once trained, the attack word prediction model 1218 shown in Figure 14 can be used to predict the next attack word in an attack sentence. The choice of model is driven by empirical results and a weighting of the model's performance versus its respective computational and memory requirements. Multi-layer perceptrons, long short-term memory (LSTM) networks, and transformers are logical architecture choices.

[0083] NLP model for attack sentence recognition

[0084] As previously disclosed, the malware engine is capable of stopping attacks based on next word prediction and recognizing coherent attack sentence fragments.

[0085] One way to detect an ongoing attack is to aggregate the results from the attack word prediction model 1218 over the last N predicted words, and when the cumulative value reaches a certain threshold, declare the processed graph as under attack and take repair steps.

[0086] Another approach is to treat attack graph classification as sentiment analysis. The model takes an attack word sequence "AW1->AW2->..->AWn" and outputs a single confidence value that is compared to a predefined threshold. Long short-term memory (LSTM) or transformer models are logical architecture choices.

[0087] 15A-15C show exemplary software code used in the system.

[0088] A computer system, computer, client, client computer, server, server computer, and computing device include one or more computing devices configured and / or programmed to perform the described functions. Furthermore, program code for implementing the disclosed functions can be stored on a computer-readable storage medium. In this context, any form of tangible computer-readable storage medium can be used, such as a magnetic storage medium or an optical storage medium. Furthermore, a computer-readable storage medium does not refer to an electrical signal that is separate from the underlying physical medium. A tangible, non-transitory computer-readable medium can be provided having instructions that, when executed by a processor, cause the processor to perform the methods described herein.

[0089] example

[0090] The software can be installed side-by-side with standard software such as Windows 10™ Point Protection™ software.

[0091] In the first example, a message is received from the CEO on the Teams app thanking you for the hard work you did last quarter. The message also has a paragraph with a link that purports to relate details about a special bonus incentive compensation plan the HR team has put together for the recipient. Many people are lured into a false sense of security and click the link to learn about the bonus, which results in the download of a file. This file could be titled "special bonus.pdf," for example. When the downloaded PDF is opened, a credential stealer is launched in place of the PDF document, capturing logins from a Google Chrome® web browser, authentication tokens from Microsoft Teams®, and so on.

[0092] The disclosed system and method address detecting computer attacks as a natural language problem. As described above, attackers express their intent by performing actions that can be considered events that can be classified as attack words. By ordering the attack words in a causal graph, a coherent attack sentence can be constructed. The coherent attack sentence is then analyzed by natural language processing to predict the next word in the attack sentence or the next phase of the attack. The use of natural language analysis provides predictive power that enables the system and method to detect and take preventative and mediation actions with a high degree of confidence. Accuracy is ensured by ensuring that attack words have a cause-and-effect relationship before they are applied to a model for inference.

[0093] In a specific attack statement, words are labeled with the corresponding attack annotation. The first annotation is a web mark. The first annotation means the file was downloaded from the web. The second annotation identifies whether a double extension, or two or more extensions, is used. The use of a double extension refers to a file that masquerades as malware and hides behind a known document type. For example, the double extension in the example above could be special.bonus.pdf.exe. And the third annotation is credential theft.

[0094] The disclosed NLP model predicts that the next most likely attack step or attack word is credential theft. When malware attempts to steal credentials, the system and method are operable to block the action (e.g., attempted credential theft) and terminate the process. The causal graph allows the system to repair everything the malware did and, most importantly, eliminate the attacker. The attacker can be eliminated.

[0095] When Google Chrome® downloaded a file, Chrome wrote special metadata indicating that the downloaded file came from the Internet. When the 7-zip process opened the archive, the disclosed system tagged the archive file with a mark indicating the Internet as its source. Then, when the 7-zip file was actually extracted, the web mark was transferred to a file called specialbonus.pdf.exe, which was also marked with a double extension. When the process began execution, it held the two first attack words, and the disclosed NLP model generated a prediction that the next action would be credential theft. As a result, the prediction matched reality, and the process terminated.

[0096] Attack classification and inference tasks can be performed locally on the Windows 10 Point™ operating system. No communication with a backend is performed for attack detection. Attack classification rules, as well as NLP model parameters, are delivered from a cloud backend powered by Microsoft Azure®.

[0097] While preferred embodiments of the present invention have been shown and described herein, it will be obvious to those skilled in the art that such embodiments are provided by way of example only. Numerous variations, changes, and substitutions will now occur to those skilled in the art without departing from the invention. For example, the use of variations such as "comprise" or "comprises" or "comprising" refers to the inclusion of a stated integer or group of integers, but not the exclusion of any other integer or group of integers. It will be understood that various alternatives to the embodiments of the invention described herein may be employed in practicing the invention. Any claims presented define the scope of the invention, and methods and structures within the scope of these claims and their equivalents are intended to be covered thereby.

Claims

1. 1. A system for operating an anti-malware behavior graph engine, comprising: Memory and a processor in operative communication with the memory; wherein the processor provides instructions and data; developing a model from an attack language including two or more attack words, the model operable to detect at least one of a combined attack and a multi-stage attack; semantically completing the attack language to describe one or more attack activities; predicting one or more of tactical and strategic attack objectives from the semantically complete attack language; using the semantically complete attack language as input to a high-level scripting environment to reproduce an attack against a computing environment; Determining the causal relationship between two or more events The system is operable to perform steps including providing behavioral information by

2. deriving a grammar for the attack language, the grammar for the attack language including a body of rules.

10. The system for operating an anti-malware behavior graph engine of claim 1, further comprising:

3. 3. The system for operating an anti-malware behavior graph engine of claim 2, wherein a sequence of two or more attack words represents a grammatically correct attack sentence.

4. 4. The system for operating an anti-malware behavior graph engine of claim 3, wherein the grammatically correct attack sentences represent one or more attacker actions for achieving one or more of the tactical attack objectives and the strategic attack objectives.

5. The system for operating an anti-malware behavior graph engine of claim 1 , further comprising monitoring one or more events obtained from the protected computing environment.

6. The system for operating an anti-malware behavior graph engine of claim 1 further comprising classifying one or more events.

7. 10. The system for operating an anti-malware behavior graph engine of claim 1, further comprising building a model for predicting one or more next attack words.

8. 10. The system for operating an anti-malware behavior graph engine of claim 1, further comprising building a model for predicting one or more next attack statements.

9. The system for operating an anti-malware behavior graph engine of claim 1 further comprising using one or more classification engines.

10. 10. The system for operating an anti-malware behavior graph engine of claim 9, further comprising determining whether at least one of the events or sequences of events represents a word within a defined vocabulary of attack words.

11. 10. The system for operating an anti-malware behavior graph engine of claim 9, further comprising using a natural language machine learning model to determine origin paths through the directed graph store of detected attack words representing semantically meaningful attack sentences.

12. 10. The system for operating an anti-malware behavior graph engine of claim 1, further comprising curating a dataset to develop a sufficient number of attack word labeling rules.

13. 1. A computer-readable storage medium configured with data and programmed instructions that, when executed by a processor, perform a method for detecting malware in a computer network, the method comprising: developing a model from an attack language including two or more attack words, the model operable to detect at least one of a combined attack and a multi-stage attack; semantically completing the attack language to describe one or more attack activities; predicting one or more of tactical and strategic attack objectives from the semantically complete attack language; using the semantically complete attack language as input to a high-level scripting environment to reproduce an attack against a computing environment; Determining the causal relationship between two or more events 1. A computer-readable storage medium comprising:

14. deriving a grammar for the attack language, the grammar for the attack language including a body of rules. The computer-readable storage medium of claim 13 further comprising:

15. The computer-readable storage medium of claim 14 , wherein a sequence of two or more attack words represents a grammatically correct attack sentence.

16. 16. The computer-readable storage medium of claim 15, wherein the grammatically correct attack sentences represent one or more attacker actions for achieving one or more of the tactical and strategic attack objectives.

17. The computer-readable storage medium of claim 13 , further comprising monitoring one or more events obtained from the protected computing environment.

18. The computer-readable storage medium of claim 13 , further comprising classifying the one or more events.

19. The computer-readable storage medium of claim 13 , further comprising building a model for predicting one or more next attack words.

20. The computer-readable storage medium of claim 13 , further comprising building a model for predicting one or more next attack statements.

21. The computer-readable storage medium of claim 13 , further comprising using one or more classification engines.

22. 22. The computer-readable storage medium of claim 21, further comprising determining whether at least one of the events or sequences of events represents a word within a defined vocabulary of attack words.

23. 22. The computer-readable storage medium of claim 21, further comprising using a natural language machine learning model to determine origin paths through a directed graph store of detected attack words that represent semantically meaningful attack sentences.

24. The computer-readable storage medium of claim 13 , further comprising curating the dataset to develop a sufficient number of attack word labeling rules.

25. 1. A system for classifying events for an anti-malware behavior graph engine, comprising: Memory and a processor in operative communication with the memory; wherein the processor provides instructions and data; Classifying events and determining whether the classified event is an attack word, ignoring the event if the classified event is not an attack word, and provisionally adding the event to an attack graph if the classified event is an attack word; classifying the attack graph; determining whether the attack graph is a valid attack statement, ignoring the event if the attack graph is not an attack statement, and committing the event to the attack graph if the attack graph is an attack statement; If the event is not ignored, blocking or terminating the malware process tree; The system is operable to perform steps including providing behavioral information by

26. checking the event against at least one classification engine; 26. The system for classifying events for an anti-malware behavior graph engine of claim 25, further comprising:

27. 27. The system for classifying events for an anti-malware behavior graph engine of claim 26, wherein the at least one classification engine includes one or more prepared attack words.

28. Applying a malware model; Recognizing important events and 26. The system for classifying events for an anti-malware behavior graph engine of claim 25, further comprising:

29. Performing feed checks against one or more threat intelligence feeds 26. The system for classifying events for an anti-malware behavior graph engine of claim 25, further comprising:

30. 30. The system for classifying events for an anti-malware behavior graph engine of claim 29, wherein the feed checks performed against the threat intelligence feed are performed in real time.

31. Performing flagged checks against one or more user-flagged attack vectors 26. The system for classifying events for an anti-malware behavior graph engine of claim 25, further comprising:

32. The temporal ordering of a sequence of events 26. The system for classifying events for an anti-malware behavior graph engine of claim 25, further comprising:

33. 1. A computer-readable storage medium configured with data and programmed instructions that, when executed by a processor, perform a method for detecting malware in a computer network, the method comprising: Classifying events and determining whether the classified event is an attack word, ignoring the event if the classified event is not an attack word, and provisionally adding the event to an attack graph if the classified event is an attack word; classifying the attack graph; determining whether the attack graph is a valid attack statement, ignoring the event if the attack graph is not an attack statement, and committing the event to the attack graph if the attack graph is an attack statement; If the event is not ignored, blocking or terminating the malware process tree; 1. A computer-readable storage medium comprising:

34. checking the event against at least one classification engine; 34. The computer-readable storage medium of claim 33, further comprising:

35. 35. The computer-readable storage medium of claim 34, wherein the at least one classification engine includes one or more prepared attack words.

36. Applying a malware model; Recognizing important events and 34. The computer-readable storage medium of claim 33, further comprising:

37. Performing feed checks against one or more threat intelligence feeds 34. The computer-readable storage medium of claim 33, further comprising:

38. 38. The computer-readable storage medium of claim 37, wherein the feed checks performed against the threat intelligence feed are performed in real time.

39. Performing flagged checks against one or more user-flagged attack vectors 34. The computer-readable storage medium of claim 33, further comprising:

40. The temporal ordering of a sequence of events 34. The computer-readable storage medium of claim 33, further comprising:

Images