Bayesian Anomaly Detection for Network Process Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity systems struggle to detect 'living off the land' attacks, which use legitimate commands/processes to evade detection, making it difficult to differentiate between malicious and legitimate activities in computer networks.
Innovation Solution
A cybersecurity system that uses a Bayesian framework to calculate global and local risk probabilities for processes executed within a network, comparing historical and real-time data to identify anomalous behavior, and provides alerts for potential cyber threats through a prediction phase analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cybersecurity systems monitor network traffic and execute commands, then they can detect obvious malicious activities, but they struggle to detect 'living off the land' attacks that use legitimate commands to evade detection
Solution Approach 1:
The system calculates local risk probabilities specific to each entity (user, host, or process) by analyzing the execution history of processes on that particular entity. This allows the system to detect anomalies tailored to each entity's unique behavior pattern, improving detection accuracy for living off the land attacks while reducing false positives from legitimate but unusual process executions.
2Reliability
If the system monitors all process executions to improve detection coverage, then it can identify more potential threats, but it increases computational complexity and processing requirements
Solution Approach 1:
The system segments the monitoring and analysis process into distinct phases: a training phase where historical data is processed to establish baseline risk probabilities, and a prediction phase where only current process executions are evaluated against the learned models. This segmentation reduces computational complexity by avoiding the need to re-analyze all historical data for each new process execution.
Solution Approach 2:
The system performs preliminary analysis during a training phase to pre-calculate global and local risk probabilities for processes based on historical execution patterns. This preliminary action stores the results in a structured format that can be quickly queried during prediction, eliminating the need for complex real-time analysis of historical data and significantly reducing computational requirements during actual threat detection.
3Measurement precision
If the system uses Bayesian frameworks to calculate risk probabilities for all process-entity combinations, then it improves detection precision, but it increases processing time during the prediction phase
Solution Approach 1:
The system performs the computationally intensive Bayesian risk probability calculations during an offline training phase using historical data. The results are stored as pre-computed values that can be quickly retrieved during the prediction phase, eliminating the need for real-time Bayesian calculations and significantly reducing processing time for new process execution analysis.
Solution Approach 2:
The system dynamically adapts its monitoring scope based on the prediction period. Instead of analyzing all historical data for every new process execution, it only retrieves and processes risk probabilities for the specific process-entity combinations relevant to the current prediction window, optimizing the balance between precision and processing speed.
Data Source
AI summary
A cybersecurity system, method, and computer program is provided for detecting whether an entity's collection of processes during an interval is abnormal compared to the historical collection of processes observed for the entity during previous intervals of the same length. Logs from a training period are used to calculate global and local risk probabilities for each process based on the process's execution history during the training period. Risk probabilities may be computed using a Bayesian framework. For each entity in a network, an entity risk score is calculated by summing the applicable risk probabilities of the unique processes executed by the entity during an interval. An entity's historical risk scores form a score distribution. If an entity's current score is an outlier on the historical score distribution, an alert of potentially malicious behavior is generated with respect to the entity. Additional post-processing may be performed to reduce false positives.