Endpoint Behavior Detection Using Adaptive Profiles and Causality Chains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing endpoint security systems struggle to accurately identify malicious attacks, particularly those exploiting zero-day vulnerabilities, due to the overabundance of false positives and the variability of 'normal' behavior across different contexts, making it difficult to distinguish between normal and abnormal events.
Innovation Solution
A security framework generates adaptive normal profiles based on event data from endpoints, filtering and normalizing it to create context-specific profiles, and uses these profiles to detect abnormal behavior by verifying process activity against these profiles and identifying causality chains using a threat detection model trained on synthetic or real-world data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional antivirus software with signature-based detection is used, then it can detect known malware, but it cannot detect zero-day threats or malware with encrypted payloads
Solution Approach 1:
The system performs preliminary actions by collecting baseline behavioral data from legitimate applications before malware infection occurs. This baseline is stored and used for comparison during runtime, enabling detection of deviations that indicate malware activity, including zero-day threats and encrypted malware that traditional signature-based systems cannot detect.
Solution Approach 2:
The patent replaces traditional mechanical signature-based detection with a behavioral analysis system that monitors runtime characteristics. Instead of relying on static malware signatures, the system dynamically analyzes process behavior, registry changes, file system modifications, and network activity patterns to detect malware based on anomalous behavior rather than predefined signatures.
2Reliability
If comprehensive system monitoring is implemented to detect all malware behaviors, then detection coverage increases, but system performance and user experience deteriorate
Solution Approach 1:
The system applies partial monitoring by focusing on specific high-risk behaviors and parameters rather than monitoring all system activities. It selectively tracks registry changes, file system operations, and process behaviors that are most indicative of malware activity, reducing overhead while maintaining effective detection coverage for critical threats.
Solution Approach 2:
The patent introduces an intermediary layer that sits between the application and the operating system, capturing behavioral data through hooks and callbacks. This intermediary approach allows the system to monitor application behavior without directly interfering with core system operations, minimizing performance impact while maintaining comprehensive monitoring capability.
3Measurement precision
If behavioral baselines are collected from all applications to improve detection accuracy, then false positives decrease, but the complexity of data management increases
Solution Approach 1:
The system segments baseline data by application, user, and behavior type, organizing collected behavioral information into structured categories. This segmentation allows efficient storage, retrieval, and comparison of baselines without managing all data as a single complex entity, reducing the complexity of baseline management while maintaining high detection accuracy through targeted comparisons.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Adaptive normal profiles are generated at a hierarchical scope corresponding to a set of endpoints and a process. Abnormal endpoint activity is detected by verifying whether event data tracking activity on the set of endpoints conforms to the adaptive normal profiles. False positives are reduced by verifying alarms correspond to normal endpoint activity. Abnormal event data is forwarded to a causality chain identifier that identifies abnormal chains of processes for the abnormal endpoint activity. A trained threat detection model receives abnormal causality chains from the causality chain identifier and indicates a likelihood of corresponding to a malicious attack that indicates abnormal endpoint behavior.