Activity Indicator Classification for Malicious Software Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods fail to accurately and efficiently identify unwanted activity in computer systems compromised by malicious software, leading to potential data loss and system disruption, as they struggle to distinguish between normal and malicious operations, and often require extensive computational resources.
Innovation Solution
A system and method that utilize a classification model trained on activity data to identify relevant indicators of unwanted activity by extracting and analyzing activity values such as time, network addresses, and registry key values, providing indicators to security engines for detection, which reduces false positives and computational costs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional methods are used to identify unwanted activity in computer systems, then detection coverage is attempted, but accuracy is low and false positives are high
Solution Approach 1:
The patent segments the identification process into multiple independent classification models, each trained on specific activity values (CPU usage, memory usage, network traffic, file operations, registry operations). This segmentation allows each model to specialize in detecting particular types of malicious behavior, improving overall accuracy while reducing false positives through targeted detection rather than broad generalization.
Solution Approach 2:
The patent transforms the detection approach by changing parameters from traditional signature-based detection to multiple activity value parameters (CPU usage patterns, memory allocation patterns, network traffic characteristics, file operation sequences, registry modification patterns). This parameter transformation enables more precise measurement and identification of unwanted activity through quantitative analysis of system behavior.
2Measurement precision
If comprehensive analysis of system activity is performed to improve detection accuracy, then identification precision improves, but computational resources and time increase
Solution Approach 1:
By dividing the detection task into multiple parallel classification models that each process specific activity values independently, the system achieves comprehensive analysis through parallelization rather than sequential processing. This segmentation maintains high detection accuracy while reducing total detection time by eliminating the need for step-by-step analysis of all system activities.
Solution Approach 2:
The patent applies partial action by implementing multiple classification models that focus on specific subsets of activity values rather than requiring complete analysis of all possible system parameters. Each model processes relevant partial information (specific CPU patterns, memory patterns, etc.) to contribute to overall detection accuracy, achieving sufficient precision without the computational burden of exhaustive analysis.
3Measurement precision
If multiple classification models are trained on different activity values to improve detection, then identification accuracy increases, but device complexity increases
Solution Approach 1:
The patent manages complexity by segmenting the detection system into modular classification models, each handling specific activity values. This modular architecture improves identification accuracy through specialized detection while controlling system complexity through organized separation of concerns, making the system more manageable and maintainable despite having multiple models.
Solution Approach 2:
The patent implements universality by designing classification models that can process multiple types of activity values (CPU, memory, network, files, registry) within a unified framework. This multi-functional approach allows the system to maintain high identification accuracy across diverse malicious behaviors while reducing overall complexity by using consistent processing logic rather than completely separate specialized systems for each activity type.
Data Source
AI summary
A method for producing a set of indicators of unwanted activity in a computer system, comprising: receiving a plurality of input data sets, each describing system activity and comprising an infection label and system activity information collected from a computer system;producing a plurality of training sets each comprising: 1) a plurality of activity values, each indicative of execution of an instruction, extracted from one of the plurality of input data sets, and 2) a respective infection label;producing for each training set one of a plurality of sets of relevant activity values by:training a model to output, in response to the respective training set, an infection classification equal to respective infection label; andanalyzing the model to identify a set of relevant activity values, of the plurality of activity values, effecting the infection classification; andanalyzing the plurality of sets of relevant activity values to produce the indicators.