Endpoint Malware Detection Using Multi-Source Graph Risk Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems face challenges in identifying new and modified malware variants, generate high false positives, lack data correlation across security functions, struggle with real-time analysis of multi-source data, and fail to adapt to evolving attack techniques, leading to incomplete insights and delayed response times.
Innovation Solution
An AI-based system using multi-source data fusion, graph neural networks, and deep learning models to generate dynamic directed graphs, assign labels, and compute maliciousness risk scores for endpoint devices, integrating endpoint visibility data with publicly available information and sandbox analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection is used, then known malware variants can be detected, but new and unknown malware cannot be identified
Solution Approach 1:
The system transitions from static signature-based detection to dynamic behavior-based analysis. The monitoring engine continuously observes file and application behaviors, system changes, and network communications in real-time, allowing the system to adapt to new malware variants without requiring updated signatures. This dynamic approach enables detection of previously unknown malware through anomaly detection in behavioral patterns.
Solution Approach 2:
The system changes the detection parameters from fixed malware signatures to variable behavioral metrics. Instead of comparing files against known signature patterns, the system monitors multiple parameters including process activities, file accesses, registry modifications, and network connections. These parameter changes allow the system to identify malicious behavior regardless of whether the malware signature is known.
2Adaptability or versatility
If heuristics and behavior-based techniques are used, then new malware can be detected, but false positives increase significantly
Solution Approach 1:
The system merges multiple data sources and analysis techniques to improve reliability. It combines monitoring engine data from multiple endpoint devices, integrates with threat intelligence platforms, and correlates information across different security functions. This multi-source data fusion approach allows the system to distinguish between legitimate and malicious behaviors more accurately, reducing false positives while maintaining high detection capability for new malware.
Solution Approach 2:
The system implements feedback mechanisms where detection results and expert analyses are fed back into the system to refine future detections. Security experts can review false positives and provide corrections, which are then used to adjust detection thresholds and improve the heuristic rules. This continuous feedback loop reduces false positive rates over time while preserving the system's ability to detect new malware variants.
3Ease of operation
If isolated security functions are used, then individual security tasks can be performed, but data correlation across security functions is lost
Solution Approach 1:
The monitoring engine is designed with multi-functionality to perform multiple security tasks simultaneously. It can monitor process activities, track file accesses, detect network anomalies, and identify registry modifications all through a single integrated platform. This universal approach eliminates the need for multiple isolated security functions and enables automatic data correlation across different security domains, preventing information loss while maintaining operational simplicity.
4Measurement precision
If manual IOC extraction is used, then detailed malware analysis can be performed, but response time is delayed
Solution Approach 1:
The system performs preliminary automated analysis of malware samples and security events before human expert review. The monitoring engine continuously collects and pre-processes security data, and the threat intelligence platform pre-analyzes potential threats using AI-based models. This preliminary action reduces the workload for manual IOC extraction and enables faster response times while maintaining detailed analysis capability through automated preprocessing.
Solution Approach 2:
The system enables self-service through automated malware analysis and IOC extraction capabilities. AI-based models automatically analyze malware samples, extract indicators of compromise, and generate threat reports without requiring manual intervention for every analysis. This self-service approach maintains measurement precision through sophisticated automated analysis while significantly reducing response time by eliminating manual processing bottlenecks.
Data Source
AI summary
An artificial intelligence (AI)-based system for detecting malware in endpoint devices using a multi-source data fusion and method thereof are disclosed. The AI-based system collects at least one of: endpoint visibility data, publicly available information, and sandbox analysis data using the multi-source data fusion. By using the collected data, the AI-based system generates one or more numerical embeddings for at least one of: one or more files and one or more applications of each endpoint device using one or more AI models. The AI-based system is configured with the one or more AI models to generate one or more dynamic directed graphs based on the generated one or more numerical embeddings to compute a maliciousness risk score. The maliciousness risk score of at least one of the: one or more files and one or more applications is used for detecting the malware in the one or more endpoint devices.