Behavioral Detection Algorithms in Trusted Execution Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems, particularly those relying on signature-based identification, struggle to effectively detect customized attacks that evolve slowly and lack visibility into endpoint devices, leading to delayed detection and high false positive alerts due to the complexity of gathering and processing large data volumes.
Innovation Solution
A distributed system that processes data between dedicated analytics servers and endpoints, using behavioral detection machine learning algorithms within a trusted execution environment to generate and analyze endpoint profiles and ontologies, reducing false positives and enhancing reaction time by providing richer contextual information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If signature-based detection is used for malware detection, then detection simplicity is maintained, but detection effectiveness deteriorates against customized attacks
Solution Approach 1:
The patent replaces traditional signature-based detection (mechanical pattern matching) with machine learning-based behavioral analysis. The system uses supervised learning algorithms to train models on endpoint behavior data, enabling detection of customized malware through anomaly detection rather than predefined signatures. This substitution maintains operational simplicity while significantly improving detection effectiveness against novel threats.
Solution Approach 2:
The system changes the detection parameters from static signature matching to dynamic behavioral parameters. By monitoring endpoint behavior patterns, system calls, and operational characteristics over time, the machine learning models detect deviations from normal behavior. This parameter transformation enables reliable detection of customized attacks that lack known signatures.
2Measurement precision
If data is gathered from multiple sources for threat detection, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent merges multiple data sources (endpoint behavior logs, system events, security telemetry) into a unified machine learning training dataset. The supervised learning approach consolidates these diverse inputs into a single analytical framework, improving detection accuracy while managing complexity through integrated processing rather than separate analysis systems.
Solution Approach 2:
The system introduces machine learning models as intermediary components between raw data collection and threat detection. These models act as mediators that automatically process, correlate, and interpret data from multiple sources, reducing the complexity burden on the overall system while maintaining high detection accuracy through learned patterns.
3Speed
If endpoint data is analyzed in real-time for threat detection, then detection speed is improved, but processing resource consumption increases
Solution Approach 1:
The system performs preliminary actions by pre-training machine learning models offline using historical endpoint data. Once trained, these models are deployed to endpoints where they perform lightweight real-time inference. This preliminary training phase separates the computationally intensive work from real-time operation, enabling fast detection with minimal resource consumption during actual threat monitoring.
Solution Approach 2:
The system implements dynamic resource allocation by adapting the level of real-time analysis based on threat levels and system conditions. During normal operation, the system uses lightweight behavioral baselines with minimal processing. When anomalies are detected, the system dynamically increases analysis depth and resource allocation, optimizing the balance between detection speed and resource consumption.
Data Source
AI summary
Distributed systems for protecting networked computer assets from compromise are disclosed. The distributed system includes one or more enterprise event sources, such as endpoint(s). The system also includes a server, such as a Big Data Analytics server, and optionally a security management server such as a Security Information and Event Management server. The Big Data Analytics server processes data collected from the enterprise event sources and produces behavioral profile models for each endpoint (or group of similar endpoints). The profiles, models, and ontology analysis are provided to the endpoints. Endpoint analytics use the output from the analytics servers to detect deviations from the endpoint's behavioral profile.