Endpoint Malware Detection via Process Chain Sequence Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security systems face challenges in detecting unknown threats due to the impossibility of obtaining signatures for all potential threats, especially those not yet analyzed by experts, using pattern matching approaches.
Innovation Solution
A machine learning model is trained using sequence codes generated from malware process chains that describe malware behavior, where an endpoint computer monitors and constructs a target process chain, converting it into a sequence code for classification to identify potential malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If pattern matching with threat signatures is used, then detection accuracy for known threats is improved, but the ability to detect unknown threats deteriorates
Solution Approach 1:
The patent transforms the detection approach by changing the parameters from static signature matching to dynamic behavioral analysis. Instead of comparing fixed threat signatures, the system converts process chains into sequence codes that represent behavioral patterns, enabling the detection of both known and unknown threats through learned behavioral characteristics rather than pre-defined signatures
Solution Approach 2:
The patent replaces the mechanical pattern matching system with a machine learning-based system. The machine learning model learns from training data to automatically identify malicious behavioral patterns, substituting the rigid mechanical signature comparison with an adaptive intelligent system that can generalize to unknown threats
2Adaptability or versatility
If machine learning model is used to detect unknown threats, then adaptability to detect both known and unknown threats is improved, but device complexity increases
Solution Approach 1:
The patent segments the complex security detection task into distinct components: process chain construction from monitored behaviors, conversion of process chains to sequence codes, machine learning model training, and classification. This segmentation allows each component to be optimized independently and simplifies the overall system architecture despite the advanced capabilities achieved
3Device complexity
If pattern matching approach is used, then device complexity is kept simple, but detection capability for evolving threats deteriorates
Solution Approach 1:
The patent introduces dynamics into the detection system by using machine learning models that can adapt and learn from new data. The system continuously improves its detection capability by training on new malware samples and behavioral patterns, making the detection mechanism dynamic rather than static, thereby improving reliability against evolving threats while maintaining manageable complexity through modular architecture
Data Source
AI summary
A system for detecting computer security threats includes a machine learning model that has been trained using sequence codes generated from malware process chains that describe malware behavior. An endpoint computer monitors the behavior of a process and constructs a target process chain that describes the monitored behavior. The target process chain includes objects that are linked by computer operations of the monitored behavior. The target process chain is converted to a sequence code that is input to the machine learning model for classification. A response action is performed against one or more objects identified in the target process chain when the machine learning model deems the target process chain as describing malware behavior.