Endpoint Event Sequence Modeling for Unknown Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems are limited in detecting both known and unknown malicious behaviors due to their reliance on static rules and lack of intelligent, automated learning capabilities, making them ineffective against evolving threats.
Innovation Solution
A system that models endpoint events as sequences using supervised machine learning to create provenance graphs, tracks behavior trends over time, and utilizes a sequence classifier to detect malicious activities, including previously unseen behaviors, by generating alerts for abnormal behavior patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static rules are used to detect malicious behavior, then detection speed is fast and precise for known behaviors, but the system cannot detect unknown or evolving malware
Solution Approach 1:
The patent replaces static mechanical rule-based detection with a dynamic machine learning system that automatically learns from data. The ML model processes sequences of behavioral events and predicts maliciousness probability, enabling the system to adapt to new malware types without manual rule updates.
Solution Approach 2:
The system performs self-learning by automatically training on behavioral data from endpoints. The ML model continuously improves its detection capability by processing new data patterns, eliminating the need for manual creation of detection rules for each new threat.
2Adaptability or versatility
If machine learning models are trained on sequences of events from provenance graphs, then detection capability for unknown malware improves, but system complexity increases
Solution Approach 1:
The patent segments the detection system into distinct functional modules: a monitoring engine that collects behavioral events, a graphing engine that builds provenance graphs, a representation engine that creates event sequences, and an ML classification engine that predicts maliciousness. This modular architecture manages complexity by isolating functions.
Solution Approach 2:
The patent introduces provenance graphs as an intermediary data structure between raw behavioral events and the ML classification model. This intermediary layer transforms complex multi-process interactions into a standardized sequence format that the ML model can process, simplifying the overall system architecture.
3Adaptability or versatility
If the system tracks behavior over long periods to detect trends, then detection of slow-changing malicious behavior improves, but data processing requirements and time delay increase
Solution Approach 1:
The patent implements dynamic sequence length adjustment where the representation engine creates sequences of variable length based on the provenance graph structure and event patterns. This allows the system to capture long-term behavior trends when necessary while maintaining fast processing for shorter, more obvious attack patterns.
Data Source
AI summary
Systems and methods for detecting malicious activity on an endpoint, the endpoint having executing processes, including tracking behavior of executing processes, generating a provenance graph to group the behavior events, transforming the provenance graph into a sequence of behavior events, training a sequence classification machine learning model based on the sequence of behavior events, processing a sequence of test behavior events using the sequence classification machine learning model to generate a probability of maliciousness, and alerting for malicious activity when the probability of maliciousness for the sequence of test behavior events is greater than a threshold.