Endpoint Threat Detection via Cross-Node Event Attribute Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems face difficulties in effectively identifying and distinguishing malicious events from benign processes due to the increasing sophistication of malware, and analyzing large networks for security threats is resource-intensive.
Innovation Solution
A method involving the collection and analysis of event attributes from endpoints, where detected security threats are used to identify similar events across the network, utilizing sensors and databases to generate alerts and take preventive actions, such as blocking or updating applications, through a server-based system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If security applications compare applications with databases of known malicious applications, then detection capability is improved, but the system cannot identify sophisticated malware that is not in the database
Solution Approach 1:
The patent segments the detection approach into two complementary layers: signature-based detection (comparing with known malware databases) and behavior-based detection (monitoring system calls and event sequences). This segmentation allows the system to maintain the precision of known malware detection while adding the versatility to detect sophisticated, unknown malware through behavioral analysis of segmented event data
Solution Approach 2:
The patent changes the detection parameter from static application identification (comparing application names, hashes, or signatures) to dynamic behavioral parameters (sequences of system calls, event timing, event relationships). This parameter change enables the system to detect sophisticated malware that may disguise its identity but maintains characteristic behavioral patterns
2Reliability
If event data from large networks is collected and analyzed to identify security threats, then threat detection coverage is improved, but resource consumption increases
Solution Approach 1:
The patent extracts only the most relevant event attributes and sequences needed for threat detection, rather than analyzing all collected event data. By extracting specific behavioral patterns and sequences that indicate threats, the system maintains comprehensive threat detection coverage while significantly reducing the computational resources required for analysis
Solution Approach 2:
The patent applies partial action by focusing analysis on specific event sequences and attributes that are most indicative of threats, rather than exhaustively analyzing all event data. This selective approach provides sufficient threat detection coverage while consuming fewer resources than complete network-wide analysis
3Adaptability or versatility
If malware becomes more sophisticated, then the ability to perform complex functions is improved, but the difficulty of distinguishing malicious events from benign processes increases
Solution Approach 1:
The patent implements feedback mechanisms where detected event sequences are continuously analyzed and compared against known malicious patterns. The system learns from detected threats and adjusts its detection criteria, providing feedback that improves its ability to distinguish malicious from benign events even as malware becomes more sophisticated and adaptable
Solution Approach 2:
The patent creates a universal detection framework that monitors multiple types of events and sequences across different applications and systems. This multi-functional approach allows the system to detect diverse malware behaviors through a unified event analysis mechanism, making it effective against sophisticated malware that may target different system functions
Data Source
AI summary
There is provided a threat control method on a computer system including: collecting one or more events from a first endpoint, each event identifying one or more attributes associated to the event; detecting a security threat related to one or more of the collected events; searching matching events from one or more further endpoints, wherein the matching event includes at least part of the same attributes than the one or more events related to the detected security threat; and in case a matching event with at least part of the same attributes is found, identifying the associated endpoint as being related to a security threat similar to what was earlier detected.