Event-Correlation Graphs for Reducing False Positives in Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security software struggles to detect and neutralize targeted attacks, particularly those using zero-day exploits, due to limitations in signature-based malware detection and heuristic classification methods, which often result in false positives and fail to provide effective zero-day protection.
Innovation Solution
The system constructs an event-correlation graph around a suspicious event on a computing system, compares it with similar graphs from other systems, and classifies the event as benign if the similarity exceeds a predetermined threshold, thereby reducing false positives and differentiating between benign and malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based malware detection is used, then known malware can be detected, but zero-day exploits and modified malware cannot be detected
Solution Approach 1:
The patent replaces signature-based detection mechanisms with event-correlation graph analysis. Instead of relying on pre-defined malware signatures, the system constructs graphs representing sequences of suspicious events and compares them against stored graphs to identify malicious patterns, enabling detection of zero-day exploits and modified malware.
Solution Approach 2:
The system changes the detection parameters from static malware signatures to dynamic event sequences represented as graphs. By analyzing the temporal and contextual relationships between events rather than fixed signature patterns, the system can adapt to new malware variants and zero-day exploits.
2Reliability
If heuristic classification methods are used to reduce false negatives, then more malware can be detected, but false positives increase
Solution Approach 1:
The system uses feedback from analyzing multiple event-correlation graphs to refine detection accuracy. By comparing the current event sequence against previously stored graphs and adjusting classification decisions based on this comparison, the system reduces both false positives and false negatives.
Solution Approach 2:
The system performs preliminary construction and storage of event-correlation graphs representing known benign and malicious patterns before actual detection occurs. This pre-computed database enables rapid comparison and classification of new event sequences, reducing real-time false positives while maintaining high detection coverage.
Data Source
AI summary
A computer-implemented method for reducing false positives when using event-correlation graphs to detect attacks on computing systems may include (1) detecting a suspicious event involving a first actor within a computing system, (2) constructing an event-correlation graph that includes a first node that represents the first actor, a second node that represents a second actor, and an edge that represents an additional suspicious event involving the first actor and the second actor, (3) comparing the event-correlation graph with at least one additional event-correlation graph that represents events on at least one additional computing system, (4) determining that a similarity of the event-correlation graph and the additional event-correlation graph exceeds a predetermined threshold, and (5) classifying the suspicious event as benign based on determining that the similarity of the event-correlation graph and the additional event-correlation graph exceeds the predetermined threshold. Various other methods, systems, and computer-readable media are also disclosed.