Cross-Machine Malware Detection via Activity Pattern Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems are limited in their ability to detect cross-machine threats and operate retrospectively, lacking context from other devices, which puts them at a disadvantage and fails to provide comprehensive analysis of malware spread across networks.
Innovation Solution
A security service system that monitors and analyzes activity patterns across multiple host devices, using a remote security service to detect and mitigate malware by grouping suspicious activity patterns and providing threat reports to analysts, enabling proactive defense against malware spread.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If retrospective analysis tools are used to detect security exploits, then detection capability is provided, but the system always operates one step behind the attacker and cannot provide proactive defense
Solution Approach 1:
The patent implements proactive security monitoring by establishing baseline activity patterns before attacks occur and continuously comparing current activity against these baselines. The system performs preliminary detection by analyzing activity patterns in real-time rather than retrospectively, enabling security teams to identify and respond to threats before they can execute their full attack vector. This shifts the operational mode from reactive (one step behind) to proactive (ahead of the attacker).
2Device complexity
If single-device analysis is used to detect security exploits, then analysis simplicity is maintained, but context from other devices is lost reducing detection accuracy
Solution Approach 1:
The patent merges activity pattern data from multiple devices into a unified analysis framework. By combining logs and activity patterns across the entire device fleet, the system can identify cross-device attack patterns, lateral movement behaviors, and coordinated threats that would be invisible in isolated single-device analysis. This multi-device contextualization significantly improves detection accuracy while maintaining manageable complexity through centralized processing.
3Reliability
If comprehensive log analysis is performed on all devices, then complete security coverage is achieved, but data processing volume and analysis complexity increase significantly
Solution Approach 1:
The patent extracts and prioritizes only the most security-relevant activity patterns from comprehensive device logs. Rather than analyzing all log data equally, the system identifies and focuses on high-value indicators such as authentication events, process executions, network connections, and file operations that are most likely to indicate security threats. This selective extraction maintains complete security coverage while dramatically reducing processing complexity and resource requirements.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computing device can install and execute a security agent that interacts with a remote security system as part of a detection loop aimed at detecting malicious attacks. The remote security system can receive observed activity patterns from the security agents associated with the computing devices. The remote security system can filter the observed activity patterns to identify "interesting" activity patterns, or activity patterns presenting indications of an attack, including any cross-machine activity. If a first host device is flagged for further threat analysis based on its filtered activity patterns, and at least one of the filtered activity patterns includes remotely accessing a second host device, then the second host device may also be flagged for further threat analysis.