Ensemble Detector for Malicious Command Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security applications and services struggle to detect sophisticated security violations, such as non-malware malicious activity, and often miss more advanced cyber threats.
Innovation Solution
A method and system that utilize a combination of natural language processing (NLP) and character-level convolutional neural networks (CNNs) to analyze command-line text and detect malicious activity, including the use of an ensemble detector to improve performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature-based security scanning is used, then known malware can be detected and removed, but sophisticated security violations such as non-malware malicious activity are missed
Solution Approach 1:
The patent combines multiple detection approaches (signature-based detection, behavior-based detection, and machine learning-based detection) into a unified security analysis system. This merging allows the system to maintain the reliability of traditional methods while gaining the adaptability to detect sophisticated threats that evade traditional signatures.
Solution Approach 2:
The security analysis system is designed to perform multiple detection functions simultaneously: it can detect known malware through signature matching, identify suspicious behaviors through monitoring, and recognize novel threats through machine learning analysis. This multi-functionality enables the system to address both traditional and sophisticated security violations with a single platform.
2Device complexity
If a single detection method is used, then the system remains simple, but detection performance is insufficient for evasive malicious commands
Solution Approach 1:
The patent implements an ensemble detector that merges multiple machine learning models (including NLP-based detectors and character-level CNN-based detectors) into a single detection system. This combination leverages the strengths of each individual model: NLP-based detectors excel at understanding command semantics while CNN-based detectors are superior at detecting obfuscation patterns, together providing comprehensive detection coverage that exceeds the capability of any single model.
3Measurement precision
If advanced detection methods like ensemble detectors are used, then detection performance improves, but system complexity increases
Solution Approach 1:
The ensemble detector is segmented into independent detection modules (NLP-based detector, CNN-based detector, etc.), each responsible for specific detection tasks. This segmentation allows the complex detection function to be divided into manageable components that can be developed, trained, and maintained independently, reducing the practical complexity despite the advanced detection capabilities.
Solution Approach 2:
The patent introduces an intermediary layer that aggregates results from multiple detection models and combines them into a unified detection decision. This intermediary component simplifies the overall system architecture by providing a standardized interface between the complex ensemble of models and the rest of the security system, making the complexity manageable through abstraction.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An event can be analyzed for association with a security violation. Characters or other values of event data (e.g., command-line text) associated with the event can be provided sequentially to a trained representation mapping to determine respective representation vectors. Respective indicators can be determined by applying the vectors to a trained classifer. A token in the event data can be located based on the indicators. The event's can be determined to be associated with a security violation based on the token satisfying a token-security criterion. The representation mapping can be trained by adjusting model parameters so the trained representation predicts, based on a character of training command-line text, an immediately following character in the training command-line text. The classifier can be determined based on the trained representation mapping and classification training data indicating whether respective portions of training event data are associated with security violations.