Coordinate Vector Security Violation Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems struggle to effectively detect and differentiate between malicious activities, including malware and non-malware threats, often missing sophisticated security violations such as unauthorized access or data exfiltration, due to reliance on signature-based detection methods that are inadequate against polymorphic malware and zero-day exploits.
Innovation Solution
A method involving the classification of events on monitored computing devices using coordinate vectors and machine learning techniques to identify potential security violations, allowing for the correlation of data from multiple events and the presentation of these events in a user-friendly interface to distinguish between clean and malicious activities, thereby reducing false positives and negatives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection methods are used, then known malware can be detected, but sophisticated security violations such as polymorphic malware and zero-day exploits are missed
Solution Approach 1:
The patent segments malicious activities into distinct categories (malware, non-malware, targeted attacks) and represents each category using specific coordinate vectors with targeted features. This segmentation allows the system to detect different types of threats using appropriate features for each category, improving both reliability for known threats and adaptability for new threats.
Solution Approach 2:
The patent transforms security event data into coordinate vectors that represent activities in a multi-dimensional space. By mapping events to coordinates based on multiple features simultaneously, the system can detect threats from multiple dimensions rather than relying on single signature matching, enabling detection of both known and unknown threats.
2Measurement precision
If multiple features are analyzed to improve detection accuracy, then false positives may increase, but reducing features improves speed
Solution Approach 1:
The patent applies different feature sets (coordinate vectors) to different types of security events based on their specific characteristics. Each event type is evaluated using locally optimized features relevant to that category, improving detection precision without unnecessarily analyzing all possible features for every event, thus maintaining processing speed.
3Reliability
If comprehensive event monitoring is implemented, then more security violations can be detected, but the volume of alerts for analysts increases
Solution Approach 1:
The patent extracts and highlights only the most significant security violations by representing events as coordinate vectors and identifying those that deviate from normal patterns. This extraction approach allows comprehensive monitoring while presenting only the most critical alerts to analysts, reducing alert volume without compromising detection reliability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Event vectors can be determined for respective events based on respective command-line records and a trained representation mapping. Respective coordinate vectors can be determined, each having fewer elements than the respective event vector. Respective representations of at least some of the events can be presented via an electronic display at the respective coordinate vectors. A selection of a first representation can be received via a user interface. The events can be clustered based on the event vectors. A first cluster can be selected based on the selection. An indication of a tag can be received via the user interface. Each event of the first cluster can be associated with the tag. Some examples include transmitting a security command to cause a monitored computing device associated with an event in the first cluster to perform a mitigation action.