Cyclic Activity Detection in Dynamic Application Event Streams
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing dynamic analysis systems face high computational costs and performance issues due to large data generation during malware analysis, leading to negative user experiences and increased resource loads.
Innovation Solution
A method and system for detecting cyclic activity in event streams during dynamic application analysis, which involves creating a buffer to track unique events and setting a threshold to identify repetitive patterns, thereby excluding cyclic events from further processing and reducing data logs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic analysis systems monitor all application events during execution, then analysis completeness is improved, but computational costs and resource load increase significantly
Solution Approach 1:
The patent extracts and identifies cyclic events from the complete event stream, separating them from unique events. By extracting only the representative events from cyclic patterns and excluding redundant repetitions, the system maintains analysis completeness for meaningful behaviors while significantly reducing computational load for processing repetitive events.
Solution Approach 2:
The system performs preliminary detection of cyclic patterns during event stream processing. By identifying cycles early and marking them for exclusion, the system prevents redundant processing of repetitive events throughout the analysis, thereby improving computational efficiency without compromising the detection of significant malicious behaviors.
2Measurement precision
If the system processes all events in the event stream, then detection accuracy is improved, but memory and disk space requirements increase
Solution Approach 1:
The patent extracts only the essential information from cyclic events (the pattern definition) and excludes redundant instances. This extraction maintains detection accuracy by preserving the identification of cyclic behaviors while dramatically reducing the volume of data that needs to be stored and processed in memory and disk.
Solution Approach 2:
The system discards redundant repetitive events from the event stream while recovering and preserving the cyclic pattern information. This allows the system to maintain accurate detection of cyclic behaviors without storing all individual event instances, thereby reducing data volume requirements.
3Speed
If real-time dynamic analysis is performed on all events, then response time is improved, but system performance degradation increases
Solution Approach 1:
The patent extracts cyclic event patterns and marks them for exclusion from further real-time processing. By removing repetitive events from the processing pipeline, the system maintains fast response times for detecting significant behaviors while reducing the computational power required for real-time analysis of the remaining unique events.
Data Source
AI summary
Disclosed herein are systems and methods for detecting cyclic activity in an event stream. In one aspect, an exemplary method comprises, creating a buffer, determining a threshold for indicating a beginning of a cycle, processing each event by filling the buffer with the event, determining a number of unique events in the buffer, when the number reaches a predetermined size of the buffer, replacing one event with another by excluding the earliest event and including the new event, recalculating the number of unique events, comparing the recalculated number with a threshold for a maximum number of unique events for cycle detection, detecting a beginning of a cycle when the number of unique events is less than or equal to the maximum number of unique events for cycle detection, excluding further events from the event stream, and continuing to recalculate the number of unique events after each addition.