Event Graph Root Cause Identification for Malware Forensics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current forensic analysis techniques face challenges in identifying the root cause of security compromises and distinguishing malicious computing activity from normal processes in complex environments, especially as malware becomes more sophisticated.
Innovation Solution
A system that records endpoint activity as sequences of causally related events, generates an event graph, and applies cause identification rules to traverse the graph in reverse and forward orders to identify the root cause of security events and affected objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional forensic analysis techniques are used, then the analysis process is simple, but the ability to identify root causes of security compromises deteriorates in complex computing environments
Solution Approach 1:
The system segments the complex computing environment into discrete computing objects (processes, files, registry keys, network connections) and tracks their individual causal relationships. This segmentation allows the complex environment to be managed through structured, manageable units rather than monolithic complexity.
Solution Approach 2:
The patent introduces a temporal dimension by recording sequences of events and establishing causal relationships over time. The event graph adds a relational dimension, mapping not just what happened but how events connect causally, enabling root cause analysis across multiple dimensions of complexity.
2Reliability
If comprehensive monitoring of all computing objects is implemented, then the detection capability improves, but the system overhead and performance impact worsen
Solution Approach 1:
The system monitors all computing objects (processes, files, registry keys, network connections) comprehensively, accepting that some monitoring overhead is necessary. The key differentiator is that this comprehensive monitoring is structured around causal relationships, allowing the system to focus on what matters for security analysis rather than generic monitoring of everything.
Solution Approach 2:
The system performs preliminary action by continuously recording sequences of events and building the event graph structure in advance. This preparation allows rapid root cause analysis when security events occur, reducing the need for intensive real-time analysis during actual incidents.
3Speed
If real-time analysis of all recorded events is performed, then the response speed to security events improves, but the processing load and latency worsen
Solution Approach 1:
The system performs preliminary action by continuously recording events and maintaining the event graph structure in advance. When a security event is detected, the graph is already prepared and indexed, allowing rapid traversal and analysis without the need for real-time processing of all historical events.
Solution Approach 2:
Instead of analyzing all recorded events from the beginning when a security incident occurs, the system inverts the approach by using the pre-built event graph to quickly navigate from the security event backward to identify root causes. This reverse traversal through the structured graph dramatically reduces processing requirements compared to sequential analysis of all events.
Data Source
AI summary
A multi-endpoint event graph is used to detect malware based on malicious software moving through a network.