Anomalous Event Detection via Convolution Popularity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing detection technologies are ineffective against new techniques of exploiting software vulnerabilities, such as return-oriented programming, and fail to detect anomalies indicative of attacks, necessitating a method to focus on external symptoms of attacks rather than the evolving exploitation methods.
Innovation Solution
A system and method that detect anomalous events in a computing device's operating system by forming a convolution of event features, determining their popularity through a database of frequency data, and flagging events with low popularity as anomalous, allowing for the identification and potential remediation of malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing detection technologies use known techniques and mechanisms to detect vulnerability exploitation, then they can detect actual exploiting of known vulnerabilities, but they fail to detect new techniques of exploitation such as return-oriented programming
Solution Approach 1:
Instead of detecting attacks by analyzing their specific techniques and mechanisms (traditional approach), the patent inverts the approach by detecting anomalies based on deviations from normal system behavior patterns. The system collects baseline data of normal operating system events and their contexts, then identifies attacks by detecting deviations from this baseline, regardless of the specific attack technique used. This inversion enables detection of both known and unknown exploitation methods.
Solution Approach 2:
The patent changes the detection parameters from analyzing specific attack techniques (code patterns, exploitation mechanisms) to monitoring statistical deviations in event frequency and context patterns. By transforming the detection basis from technique-specific parameters to behavioral statistical parameters, the system gains the ability to detect various attack types including return-oriented programming that were previously undetectable.
2Reliability
If defensive technologies focus on preventing specific exploitation techniques, then they can protect against known vulnerabilities, but they become powerless against evolving attack methods like return-oriented programming
Solution Approach 1:
The patent creates a universal detection system that does not need to be specifically configured for different attack types. By establishing a baseline of normal system behavior and detecting deviations from it, the single system can identify various exploitation techniques including return-oriented programming, shellcode execution, and other attacks without requiring technique-specific detection rules, thus achieving multi-functional protection capability.
Solution Approach 2:
The system performs preliminary action by collecting and analyzing normal system operation data to establish a baseline behavior profile before attacks occur. This pre-established baseline enables the system to quickly identify anomalies and potential attacks without needing to know or anticipate specific attack techniques in advance, providing proactive protection against evolving threats.
3Measurement precision
If detection systems analyze specific exploitation techniques and mechanisms, then they can identify known attack patterns, but they cannot detect deviations indicating new attack methods
Solution Approach 1:
The patent extracts the essential characteristic of attacks not as specific technique patterns but as deviations from normal behavior. By taking out the common element (anomaly detection) from the complex variety of attack techniques, the system simplifies detection to monitoring behavioral deviations, thereby detecting both known patterns and unknown techniques that share the common characteristic of being abnormal.
Solution Approach 2:
Instead of trying to identify all possible attack patterns (difficult and evolving), the patent inverts the approach by defining normal behavior and detecting anything that deviates from it. This inversion transforms the difficult problem of identifying unknown attacks into the more manageable task of detecting statistical anomalies in system behavior.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method is provided for detecting anomalous events occurring in an operating system of a computing device. An exemplary method includes detecting an event that occurs in the operating system of the computing device during execution of a software process. Moreover, the method includes determining a context of the detected event and forming a convolution of the detected event based on selected features of the determined context of the detected event. Further, the method includes determining a popularity of the formed convolution by polling a database containing data relating to a frequency of detected events occurring in client devices in a network, where the detected events of the client devices correspond to the detected event in the computing device. If the determined popularity is below a threshold value, the method determines that the detected event is an anomalous event.