Endpoint Threat Detection via Root-Cause Chain Linking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security systems rely on pattern matching, which is ineffective in detecting unknown threats that have not been analyzed by experts, as it is impossible to obtain signatures for all potential threats.
Innovation Solution
The approach involves describing the behavior of a computer security threat in a root-cause chain, represented by a detection rule that includes objects and operations, allowing an endpoint computer to establish links between these objects upon detection of corresponding operations, thereby identifying the threat when all links are established.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If pattern matching with signatures is used to detect threats, then detection accuracy for known threats is improved, but the ability to detect unknown threats deteriorates
Solution Approach 1:
The system transitions from static signature matching to dynamic behavior analysis. Instead of relying on fixed threat signatures, the system continuously monitors and analyzes the behavioral patterns of processes, establishing detection rules that adapt to various threat types including unknown threats by focusing on what threats do rather than what they are
Solution Approach 2:
The system changes the detection parameters from static signatures (hashes, IP addresses) to dynamic behavioral parameters (process actions, file modifications, registry changes). This parameter transformation enables detection of unknown threats while maintaining accuracy for known threats through multi-parameter correlation
2Reliability
If signature-based detection is used, then false positives are reduced, but detection coverage for all threats deteriorates
Solution Approach 1:
The system segments threat detection into multiple independent detection rules, each monitoring specific behavioral parameters. Instead of relying on a single signature match, the system divides detection into multiple behavioral indicators that must collectively confirm a threat, improving both reliability through verification and coverage through multiple detection angles
Solution Approach 2:
The behavioral detection rules serve multiple functions simultaneously - they detect known threats, unknown threats, and provide a framework for detecting emerging threats. The same rule structure can identify various threat types by differentiating based on behavioral patterns rather than requiring separate signatures for each threat
Data Source
AI summary
A behavior of a computer security threat is described in a root-cause chain, which is represented by a detection rule. The detection rule includes the objects of the root-cause chain and computer operations that represent links of the root-cause chain. An endpoint computer establishes a link between objects described in the detection rule when a corresponding computer operation between the objects is detected. Detected computer operations are accumulated to establish the links between objects. The threat is identified to be in the computer when the links of the detection rule have been established.