Application Execution Lineage Tracing for Network Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security threat detection systems in enterprise, cloud, and IoT environments face challenges in efficiently identifying and responding to internal security threats that propagate within networks, often taking over 200 days to detect data exfiltration, and require deep packet inspection, which can be resource-intensive and inefficient.
Innovation Solution
The implementation of Application Execution and Connection Lineage Tracing (AE-CLT) filtering, which tracks user-to-machine, machine-to-machine, and user-to-user communications, generates baseline signatures to detect anomalies, and uses a collector server to combine activity data with context information to identify potential threats, allowing for scalable threat detection and response without deep packet inspection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection is used to detect security threats, then detection precision is improved, but device complexity and resource consumption increase
Solution Approach 1:
The patent extracts and monitors specific metadata attributes from network packets without performing deep packet inspection. Sensors collect connection information (source/destination IPs, ports, protocols) and application execution information (process IDs, command lines, file paths) separately, then combine these extracted attributes to create monitoring data that identifies security threats without examining packet contents in depth.
Solution Approach 2:
The monitoring system is segmented into multiple specialized sensors: connection sensors that monitor network traffic metadata, application sensors that track process execution, and collectors that aggregate data from multiple sources. This segmentation allows each component to focus on specific attributes, improving detection precision while distributing system complexity across multiple simple, specialized modules rather than one complex deep inspection system.
2Measurement precision
If comprehensive activity monitoring is implemented to detect internal threats, then detection precision is improved, but loss of time increases due to data processing overhead
Solution Approach 1:
The system performs preliminary actions by continuously collecting and storing connection and application execution metadata in real-time before threats materialize. Baseline behavior patterns are established in advance through continuous monitoring of normal activity, enabling rapid anomaly detection when threats occur without requiring time-consuming analysis of raw packet data during incident response.
Solution Approach 2:
The patent introduces intermediate data structures (connection lineage graphs, application execution trees, and metadata attribute sets) that serve as mediators between raw sensor data and threat detection algorithms. These intermediaries organize comprehensive monitoring data into structured formats with predefined attributes, enabling efficient comparison and analysis that reduces processing time while maintaining high detection precision.
3Measurement precision
If metadata attributes are combined with context information to generate activity records, then detection precision is improved, but quantity of data increases
Solution Approach 1:
The system applies local quality by selectively combining metadata attributes with context information based on specific monitoring needs and threat types. Different attribute sets are used for different detection scenarios: connection lineage attributes for network threats, application execution attributes for malware detection, and file access attributes for data exfiltration. This selective combination maintains high detection precision while avoiding unnecessary data generation for each monitoring context.
Data Source
AI summary
Systems and methods for detecting security threats using application execution and connection lineage tracing with embodiments of the invention are disclosed. In one embodiment, detecting suspicious activity in a network includes receiving at a collector server a first activity data including a first set of attributes, combining a first set of context information with the activity data to generate a first activity record, comparing the first activity record to a set of baseline signatures, incrementing a count of a first matching baseline signature when the first activity record has the same values for all attributes, receiving from a second activity data including a third set of attributes, combining a second set of context information with the second activity data to generate a second activity record, and generating an alert when the attributes of the second activity record differ from all baseline signatures.