Data Processing Unit Behavioral Graphs for Real-Time Malicious Activity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions are ineffective in detecting cyber attacks in real-time due to malicious actors continually evolving their methods, making it difficult to prevent data breaches by obfuscating their actions and using circuitous routes.
Innovation Solution
Utilizing data processing units (DPUs) to generate behavioral graphs in real-time, processing telemetry at the endpoint to detect malicious activities by analyzing relationships between processes, files, and network connections, and predicting potential threats to prevent them.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security solutions use traditional detection methods, then they can identify known threats, but they fail to detect evolving malicious activities in real-time
Solution Approach 1:
The system performs preliminary actions by generating behavioral graphs that capture expected system behavior patterns before attacks occur. These baseline behavioral graphs are created from normal system operations and stored for comparison, enabling the system to quickly identify deviations that indicate malicious activity without waiting for threat signatures to be developed.
Solution Approach 2:
The system implements dynamics by continuously updating behavioral graphs in real-time as system operations occur. The behavioral graphs are dynamically regenerated based on current system state, allowing the security solution to adapt to changing legitimate behaviors while maintaining sensitivity to malicious patterns. This dynamic approach enables real-time detection without relying on static threat databases.
2Reliability
If security solutions analyze all system activities in detail, then they can detect malicious behaviors, but the complexity and computational resources required increase significantly
Solution Approach 1:
The system applies segmentation by dividing complex system behavior into discrete, manageable behavioral graphs that represent specific system components, processes, or time periods. Each behavioral graph captures a particular aspect of system behavior independently, making analysis more tractable. The overall security assessment is formed by synthesizing results from multiple segmented behavioral graphs rather than analyzing all system activities as one monolithic structure.
Solution Approach 2:
The system replaces complex mechanical analysis of individual system events with a graph-based computational model. Instead of manually analyzing each system call, file access, or network packet, the system transforms these events into graph nodes and edges that can be processed algorithmically. This substitution enables automated, scalable analysis of system behavior without requiring proportional increases in analytical complexity.
3Reliability
If security solutions process data centrally, then they can maintain comprehensive security policies, but real-time processing speed decreases due to data transmission delays
Solution Approach 1:
The system segments security processing by generating and analyzing behavioral graphs locally at distributed system nodes rather than centralizing all data collection and analysis. Each node independently creates behavioral graphs from its own operational data, enabling parallel processing and eliminating the need to transmit raw event data to a central server for analysis. This segmentation maintains security policy enforcement while dramatically improving processing speed.
Solution Approach 2:
The system introduces behavioral graphs as an intermediary representation between raw system events and security policy enforcement. Instead of directly comparing raw events against security policies, the system transforms events into behavioral graphs that serve as an intermediate layer. This intermediary structure enables more efficient policy evaluation by working with condensed behavioral patterns rather than raw event streams, improving both speed and scalability.
Data Source
AI summary
The present technology provides solutions for performing real-time analytics based on generated telemetry. An example method includes identifying an executable file and one or more actions performed on a host, where the one or more actions are associated with the executable file, generating, by a data processing unit, a behavioral graph having one or more nodes based on the executable file and the one or more actions, and determining, by the data processing unit, that the executable file is a malicious file based on the behavioral graph. Computer-readable media and systems are also provided.