Event-Triggered Behavior Analysis for Data Center Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current behavioral analysis solutions in data centers face inefficiencies, including high resource overhead and delayed detection of unexpected behaviors due to monitoring all device behaviors or focusing only on specific behaviors, which can miss malicious activities.
Innovation Solution
An event-triggered behavior analysis mechanism that uses an event monitor, behavior collector, and automated verification module to identify unexpected behaviors by comparing expected and actual behavior data during observation and monitoring periods, employing unsupervised machine learning techniques like one-class SVM.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all behaviors of a computing device are monitored and examined, then detection accuracy of unexpected behaviors is improved, but resource overhead (compute and storage) increases significantly
Solution Approach 1:
The patent extracts and monitors only specific behaviors relevant to security threats rather than all behaviors. The system identifies and focuses on critical behavior patterns that indicate malicious activities, eliminating the need to process unnecessary data while maintaining detection accuracy.
Solution Approach 2:
The patent applies different monitoring strategies to different behaviors based on their security relevance. High-priority behaviors receive intensive monitoring while low-priority behaviors are monitored minimally or not at all, creating a differentiated quality of monitoring across different behavior types.
2Reliability
If all behaviors of a computing device are monitored, then comprehensive coverage of malicious activities is achieved, but detection delay increases due to processing large amounts of information
Solution Approach 1:
The patent extracts only the most security-critical behaviors for real-time monitoring, enabling rapid detection of malicious activities. By filtering out non-critical behaviors, the system achieves fast detection without sacrificing coverage of important security events.
Solution Approach 2:
The patent implements periodic monitoring at different frequencies based on behavior criticality. Critical security behaviors are monitored continuously with high frequency, while less critical behaviors are monitored periodically at lower frequencies, optimizing detection speed across all behavior types.
3Use of energy by moving object
If behavioral analysis focuses only on a certain set of behaviors, then resource overhead is reduced, but detection accuracy decreases for unrelated malicious activities
Solution Approach 1:
The patent implements a dynamic monitoring framework that adapts the set of monitored behaviors based on system state, threat intelligence, and observed patterns. The system can dynamically add or remove behaviors from the monitoring list, ensuring comprehensive coverage of emerging threats while maintaining resource efficiency.
Solution Approach 2:
The patent incorporates feedback mechanisms where detection results and system behavior patterns are continuously analyzed to adjust the monitoring scope. When new threat patterns are detected, the system automatically expands monitoring to relevant behaviors, ensuring accurate detection without permanently increasing resource overhead.
4Use of energy by moving object
If behavioral analysis focuses only on network-related behaviors, then resource overhead is reduced, but security threats in other domains (e.g., file system) are missed
Solution Approach 1:
The patent implements dynamic scope adjustment that allows the monitoring system to expand or contract based on detected threats. When network anomalies are detected, the system can dynamically add file system or other domain monitoring, ensuring comprehensive security coverage while maintaining resource efficiency during normal operation.
Solution Approach 2:
The patent creates a universal monitoring framework that can handle multiple behavior domains (network, file system, process, etc.) through a unified architecture. This allows the system to selectively activate different monitoring domains as needed, providing comprehensive security coverage without permanently allocating resources for all domains simultaneously.
Data Source
AI summary
Certain aspects herein provide a system and method for performing behavior analysis for a computing device by a computing system. In certain aspects, a method includes detecting an event occurring at the computing device at a first time, determining, based on the detecting, an event category of the event, and collecting first one or more behaviors associated with the determined event category occurring on the computing device based. The method also includes comparing the first one or more behaviors with a dataset indicating one or more expected behaviors of the computing device associated with the event. Upon determining that at least one of the first one or more behaviors corresponds to an unexpected behavior based on the comparing, the method further includes taking one or more remedial actions.