Cross-Sectional Variance Engine for Threat Triage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus and anti-malware scanners struggle to identify highly customized and targeted advanced persistent threats (APTs) due to their unique nature, which traditional malware scanners often miss, and the sheer volume of data collected by large enterprises complicates the triaging of suspicious objects for thorough analysis.
Innovation Solution
A system and method utilizing a global and enterprise variance engine to compute cross-sectional variance scores by applying a machine learning model to determine the uniqueness of suspicious objects, employing a Hariri isolation forest algorithm for efficient and scalable analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware scanners are used to identify suspicious objects, then detection capability for common malware is maintained, but detection precision for highly customized APTs deteriorates
Solution Approach 1:
The system segments the analysis into two distinct variance calculations: global variance (comparing object to all objects across all enterprises) and enterprise-specific variance (comparing object to other objects within the same enterprise). This segmentation allows the system to detect both widely distributed threats and highly customized APTs that are unique to specific enterprises, resolving the contradiction between maintaining broad detection capability and adapting to customized threats.
2Quantity of substance
If comprehensive data collection is performed across large enterprises, then analysis coverage is improved, but triaging efficiency deteriorates due to data volume
Solution Approach 1:
The system extracts only the most critical information needed for triaging by calculating variance scores that quantify how unusual each object is. Instead of manually reviewing all collected data, the system extracts a prioritized list of objects with highest global and enterprise variance scores, enabling efficient triaging while maintaining comprehensive data collection. This extraction approach resolves the contradiction between broad coverage and triaging efficiency.
3Reliability
If deep analysis is performed on all suspicious objects, then detection thoroughness is improved, but analysis time deteriorates
Solution Approach 1:
The system performs preliminary variance analysis on all suspicious objects before committing resources to deep analysis. By calculating global and enterprise variance scores as a preliminary filtering step, the system identifies a small subset of high-priority objects that warrant thorough deep analysis. This preliminary action ensures detection thoroughness for the most critical threats while minimizing time loss by avoiding exhaustive analysis of all objects.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
There is disclosed in one example a computing apparatus, including: a processor and a memory; a data store having stored thereon trained models M GLOBAL and M ENT , wherein model M GLOBAL includes a clustering model of proximity and prevalence of a first body of computing objects, and M ENT includes a clustering model of proximity and prevalence of a second body of computing object; and instructions encoded within the memory to instruct the processor to: receive an object under analysis; apply a machine learning model to compute a global variance score between the object under analysis and M GLOBAL ; apply the machine learning model to compute an enterprise variance score between the object under analysis and M ENT ; compute from the global variance score and the enterprise variance score a cross-sectional variance score; and assign the object under analysis an analysis priority according to the cross-sectional variance score.