Autoencoder Anomaly Detection for Computing Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional detection systems rely on rules-based policies that struggle to identify malicious behavior in software tools used for legitimate purposes, as they often require similar tactics from attackers, making it difficult to detect anomalous behavior within computing sessions.
Innovation Solution
The use of autoencoders, specifically adversarial autoencoders, to process execution events from computing sessions, reconstruct them, and detect anomalies based on reconstruction errors, allowing for the identification of potentially malicious activities that fall outside legitimate uses of software tools.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rules-based policies are used to detect malicious activity, then known attack patterns can be identified, but novel or anomalous malicious behavior cannot be detected
Solution Approach 1:
The patent replaces rules-based detection mechanisms with machine learning models (autoencoders and adversarial autoencoders) that automatically learn patterns from data. These models substitute manual rule creation with automated anomaly detection based on reconstruction errors, enabling detection of both known and novel malicious behaviors without requiring explicit rules for each attack type.
Solution Approach 2:
The patent transforms the detection approach by changing from fixed rule parameters to dynamic learning parameters. The system uses reconstruction error thresholds and model weights that adapt based on training data, allowing the detection system to evolve its parameters automatically rather than relying on static rules that must be manually updated for each new attack type.
2Measurement precision
If conventional detection systems compare commands to known malicious patterns, then similar attacks can be detected, but attacks using different tactics remain undetected
Solution Approach 1:
Instead of trying to identify what is malicious by comparing against known patterns, the system inverts the approach by learning what is normal behavior and detecting anomalies as deviations from this baseline. The autoencoder learns to reconstruct normal command sequences accurately, and any significant reconstruction error indicates potentially malicious behavior, regardless of whether it matches known attack patterns.
3Productivity
If software tools are used for legitimate purposes, then productivity is maintained, but these same tools can be maliciously compromised
Solution Approach 1:
The system implements continuous monitoring and feedback by analyzing command line executions in real-time during computing sessions. The machine learning models provide feedback on whether observed tool usage deviates from learned normal patterns, enabling dynamic security responses that protect legitimate productivity while detecting malicious compromises of the same tools.
Data Source
AI summary
The disclosed computer-implemented method for detecting anomalous behavior within computing sessions may include (i) identifying, by the computing device, a set of execution events that correspond to a computing session, (ii) providing, by the computing device, the set of execution events as input to an autoencoder, (iii) receiving, by the computing device and from the autoencoder, a reconstruction error associated with autoencoding the set of execution events, (iv) detecting, by the computing device and based on the reconstruction error, an anomaly within the computing session, and (v) performing, by the computing device, a security action to address the anomaly within the computing session. Various other methods, systems, and computer-readable media are also disclosed.