Correlation-Based Security Exploit Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security applications and services often miss sophisticated security exploits as they lack the ability to correlate detected events, which may individually be innocent but collectively indicate security exploit activity.
Innovation Solution
A security agent on a monitored computing device receives event notifications related to object execution and activities, correlates these events using a filter/logic and correlator, and generates exploit detection events to drive preventative action or tracking, communicating with a remote security service for policy updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If security applications and services use signature-based scanning to detect exploits, then detection of known exploits is improved, but detection of sophisticated or novel exploits deteriorates
Solution Approach 1:
The patent segments the detection process into multiple independent components: event collection, event normalization, correlation rule evaluation, and exploit detection. Each component handles specific aspects of security monitoring, allowing the system to detect both known signatures and sophisticated novel exploits through different detection mechanisms working in parallel
Solution Approach 2:
The security system implements multi-functionality by combining signature-based detection, behavior-based detection, and correlation-based detection in a single unified platform. The correlation engine can evaluate multiple types of events (network, file system, registry, process) against various correlation rules to detect different categories of exploits, making the system adaptable to both known and novel threats
2Speed
If security applications monitor multiple individual events separately, then event detection speed is improved, but exploit detection capability deteriorates
Solution Approach 1:
The system performs preliminary action by collecting and normalizing security events in real-time, storing them in an optimized format with pre-computed attributes. Correlation rules are pre-compiled and indexed, allowing the system to rapidly evaluate multiple correlation scenarios without delaying exploit detection. This preliminary preparation enables both fast event processing and reliable correlation-based detection
Solution Approach 2:
The patent introduces an intermediary correlation engine that acts as a mediator between individual event sources and the final exploit detection. This correlation engine normalizes events from multiple sources, applies correlation rules to identify patterns, and produces unified exploit detections. The intermediary layer maintains both processing speed through optimized event handling and detection reliability through comprehensive pattern analysis
Data Source
Figure 1a
Figure 1b
Figure 2
AI summary
A security agent implemented on a monitored computing device is described herein. The security agent is configured to receive an event notification indicative of execution of an object and store, in a data structure on the monitored computing device, information associated with the event notification and the object. The security agent is further configured to receive an event notification indicative of an occurrence on the monitored computing device of an activity. Based at least in part on the stored information, the security agent correlates the occurrence of the activity with the execution of the object and generates an exploit detection event based on the correlating.