Fileless Threat Detection via Code Fragment Inference
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security measures are inadequate in detecting and mitigating fileless security threats, known as 'living off the land' attacks, which do not rely on traditional portable executables and can evade detection by dynamic behavior analysis tools.
Innovation Solution
A two-stage threat detection and mitigation system comprising a detection engine and an inference engine that identifies suspicious code fragments and reconstructs a rolling map to classify potential attacks, using a combination of prefiltering, feature extraction, and machine learning classifiers to predict and verify connections between fragments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus and behavior analysis tools are used, then detection of traditional portable executable threats is improved, but detection of fileless security threats deteriorates
Solution Approach 1:
The patent segments the detection process into two distinct stages: a detection engine that identifies suspicious code fragments using prefiltering and feature extraction, and an inference engine that reconstructs attack scenarios by analyzing connections between fragments. This segmentation allows each component to specialize in specific tasks, improving overall detection capability for both traditional and fileless threats while maintaining reliability.
2Measurement precision
If dynamic behavior analysis tools are used, then detection of executable behavior is improved, but detection of fileless attacks deteriorates
Solution Approach 1:
The patent extracts code fragments from various persistent system elements (registry entries, scheduled tasks, WMI entries, etc.) without requiring full executable behavior. The detection engine extracts and analyzes individual suspicious fragments, while the inference engine reconstructs the complete attack picture by connecting these extracted fragments, thereby detecting fileless attacks without relying on traditional dynamic behavior analysis of complete executables.
3Reliability
If a comprehensive threat detection system is implemented, then detection accuracy is improved, but system complexity deteriorates
Solution Approach 1:
The patent implements a dynamic two-stage detection system where the detection engine and inference engine operate in sequence with flexible data flow. The system dynamically adjusts its analysis depth based on suspicion levels, using prefiltering to quickly eliminate benign fragments before applying more complex feature extraction and connection analysis only to suspicious cases, thereby maintaining high accuracy while managing system complexity.
Data Source
AI summary
There is disclosed in one example a computing apparatus, including: a hardware platform; and a storage medium having stored thereon executable instructions to provide an inference engine configured to: receive a new suspicious fragment object from a protected device; add the new suspicious fragment object to a rolling map configured to provide a temporal snapshot of suspicious fragment objects over a time span; determine a connection between the new suspicious fragment object and an existing suspicious fragment object within the rolling map; apply the connection to a connection map; and operate a map classifier to determine that the connection map represents a probable computer security threat.