Endpoint Process Detection via User Activity Timing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-virus solutions are ineffective in detecting malicious activity in computer networks, leading to undetected security incidents due to reliance on signature-based detection methods, overwhelming security teams with numerous alerts.
Innovation Solution
A system and method that identify suspicious processes on end-point devices by distinguishing between processes initiated before and after a user-dependent process, using time pointers to determine if a process was initiated by a user, and generating alerts for unauthorized processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection methods are used to identify malicious activity, then known viruses can be detected and removed, but malicious activity may go undetected and security teams are overwhelmed with numerous alerts
Solution Approach 1:
The patent changes the detection parameters from static virus signatures to dynamic process behavior characteristics including creation time, user account information, command line arguments, and working directory. This allows the system to detect malicious processes based on their behavioral parameters rather than relying solely on known virus signatures, thereby improving detection effectiveness while reducing false alerts.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with an automated analysis system that collects process information, compares it against user-dependent processes, and automatically determines suspiciousness. This substitution reduces manual security team intervention and minimizes alert fatigue by providing more accurate automated detection.
2Reliability
If comprehensive process monitoring is implemented to identify suspicious processes, then security detection capability is improved, but system complexity and resource consumption increase
Solution Approach 1:
The patent extracts only the essential parameters needed for suspicious process detection: process creation time, user account information, command line arguments, and working directory. By extracting only these critical pieces of information rather than monitoring all process attributes, the system achieves effective security detection while maintaining manageable complexity and resource consumption.
Solution Approach 2:
The patent segments the detection process into distinct modules: information collection, time pointer identification, user-dependent process identification, and suspicious process determination. This segmentation allows each module to handle specific tasks independently, reducing overall system complexity while maintaining comprehensive detection capability.
3Reliability
If traditional anti-virus applications are deployed to detect malicious activity, then security coverage is provided, but response time is delayed taking days, weeks or months per alert
Solution Approach 1:
The patent performs preliminary actions by continuously collecting and storing process information including time pointers and user account data before malicious activity occurs. When a new process is created, the system can immediately compare it against stored information and generate real-time alerts, eliminating the delayed response characteristic of traditional anti-virus applications that analyze alerts after they occur.
Data Source
AI summary
A computerized method for identification of suspicious processes executing on an end-point device communicatively connected to network, the network communicatively connected to a server, the method comprising receiving, by the server, a record of at least one process, initiated by and executing on by the end-point device. One or more parameters associated with the at least one process are identified. A first time pointer is identified corresponding to the identified one or more parameters, a first time pointer. A second time pointer at which a user associated with the end-point device initiated a user dependent process is identified. Whether the second time pointer occurred before the first time pointer is identified. It is determined whether the at least one process was initiated by the user based on identification of user dependent processes and corresponding attribution. An action is performed based on the above determination.