Event-Correlation Graphs for Targeted Attack Remediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security software struggles to detect and remediate targeted attacks, especially those involving zero-day exploits and human-driven behaviors across multiple uniquely configured computing devices, due to limitations in signature-based approaches and behavior-based heuristics, which often fail to distinguish malicious from legitimate activities and do not adequately represent live production environments.
Innovation Solution
The use of event-correlation graphs to detect suspicious events, construct graphs representing actors and their relationships, and generate remediation procedures to address the impact of attacks, including resetting security credentials, removing malware, and improving application security, by analyzing the global impact of attacks across a computing system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based approaches are used to detect malware, then known malware can be identified, but zero-day exploits and newly crafted malware cannot be detected
Solution Approach 1:
The patent transitions from signature-based detection (static parameter matching) to behavior-based detection (dynamic parameter monitoring). By monitoring system calls, file operations, registry modifications, and network communications, the system detects malware based on its behavioral parameters rather than static signatures, enabling detection of zero-day exploits that have not been previously identified.
Solution Approach 2:
The system implements dynamic monitoring of computing system operations, continuously tracking process executions, file accesses, and network communications. This dynamic approach allows the system to adapt to new threats in real-time by observing actual behavior patterns rather than relying on pre-defined static signatures, thereby improving detection of evolving malware variants.
2Measurement precision
If behavior-based heuristics are used to detect targeted attacks, then malicious activities can be identified, but the system cannot distinguish individual malicious behaviors from legitimate behaviors in slow-paced attacks
Solution Approach 1:
The patent segments the analysis into discrete event types (process creations, file creations, registry modifications, network communications) and tracks them individually within an event-correlation graph. Each event is analyzed in context with other events, allowing the system to distinguish malicious sequences from legitimate isolated activities. This segmentation enables reliable detection of slow-paced attacks by identifying patterns across multiple segmented event types.
Solution Approach 2:
The system implements feedback loops where detected events trigger graph construction and analysis, which in turn generates remediation recommendations. The event-correlation graph continuously updates as new events are detected, providing feedback that refines the detection accuracy over time. This feedback mechanism allows the system to learn from detected patterns and improve its ability to distinguish malicious from legitimate behaviors in subsequent monitoring.
3Ease of manufacture
If traditional security software analyzes malware impact on isolated computing systems, then remediation procedures can be generated, but the procedures have limited utility for live production systems with unique configurations
Solution Approach 1:
The patent creates a virtual representation (event-correlation graph) that copies and models the actual attack patterns observed in live production systems. Rather than relying on isolated lab analyses, the system captures real event sequences from production environments and uses these copied patterns to generate remediation procedures that are directly applicable to the actual system configurations and attack vectors encountered in practice.
Solution Approach 2:
The event-correlation graph approach provides a universal framework that can analyze diverse attack types across different system configurations. By modeling events in a configuration-agnostic manner (process executions, file operations, network communications), the system generates remediation procedures that are adaptable to various live production environments, overcoming the limitation of isolated system analyses that only apply to specific test configurations.
4Measurement precision
If security software monitors individual malicious behaviors, then specific attacks can be detected, but the global impact of attacks spanning multiple computing devices cannot be analyzed
Solution Approach 1:
The patent merges individual event detections across multiple computing devices into a unified event-correlation graph. By combining process creations, file operations, registry modifications, and network communications from multiple devices into a single graphical model, the system achieves both precise individual attack detection and comprehensive global impact analysis. The merged graph reveals attack patterns and relationships that span across the entire computing system infrastructure.
Data Source
AI summary
A computer-implemented method for using event-correlation graphs to generate remediation procedures may include (1) detecting a suspicious event involving a first actor within a computing system, (2) constructing, in response to detecting the suspicious event involving the first actor, an event-correlation graph that includes (i) a first node that represents the first actor, (ii) a second node that represents a second actor, and (iii) an edge that interconnects the first node and the second node and represents an additional suspicious event involving the first actor and the second actor, and (3) using the event-correlation graph to generate a procedure for remediating an effect of an attack on the computing system that is reflected in the event-correlation graph. Various other methods, systems, and computer-readable media are also disclosed.