Foundational Language Model for Endpoint Malicious Activity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for detecting malicious activity in endpoint logs are limited by their reliance on predefined rules that focus on known patterns, making them ineffective against evolving threats and new malware variants.
Innovation Solution
A method utilizing a foundational language model that processes endpoint logs to generate a provenance graph, identifies trigger actions, and trains the model to predict resultant events, thereby detecting malicious activity with minimal human intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If predefined rules are used to detect malicious activity in endpoint logs, then detection speed and precision for known patterns are improved, but the ability to detect unknown or evolving threats deteriorates
Solution Approach 1:
The system transitions from static predefined rules to a dynamic neural network model that continuously learns from new data. The model adapts its detection capabilities by training on evolving malware patterns and behaviors, enabling it to detect both known and unknown threats effectively.
Solution Approach 2:
The invention changes the fundamental parameter of detection from rule-based pattern matching to machine learning-based behavioral analysis. By transforming the detection mechanism into a trainable model with adjustable parameters, the system gains the ability to adapt to new threats while maintaining high detection precision.
2Measurement precision
If manual rule creation is used for malware detection, then detection accuracy for known patterns is improved, but the time and resources required for updates increase
Solution Approach 1:
The neural network model performs self-learning by automatically training on new malware samples and behavioral data. Instead of requiring manual rule creation and updates, the system autonomously improves its detection capabilities by processing new data and adjusting its internal parameters, significantly reducing update time and resource requirements.
Solution Approach 2:
The system performs preliminary training on diverse malware patterns and behaviors to pre-establish detection capabilities. This preliminary action enables the model to quickly adapt to new threats without requiring extensive manual rule creation, reducing the time needed for detection system updates.
3Adaptability or versatility
If comprehensive log analysis is performed to detect all possible threats, then detection coverage is improved, but computational complexity and processing time increase
Solution Approach 1:
The system extracts only the most relevant features and behaviors from comprehensive logs using the trained neural network model. By focusing on key indicators of malicious activity identified through learning, the system achieves high detection coverage without the need to analyze every log entry in detail, thereby reducing computational complexity.
Solution Approach 2:
The model applies partial analysis by focusing computational resources on the most suspicious or relevant log entries identified through its learned patterns. Instead of uniformly analyzing all logs, the system performs deeper analysis only where needed, optimizing the balance between detection coverage and computational complexity.
Data Source
AI summary
Disclosed herein are systems and method for detecting malicious activity. A method may receive a plurality of logs indicative of software behavior from an endpoint device and generate, based on the plurality of logs, a provenance graph that represents relationships between different types of data objects on the endpoint device. The method may detect a plurality of trigger actions in the provenance graph and generate, for each respective trigger action of the plurality of trigger actions, a sequence of events that contributed to an occurrence of the respective trigger action. The method may train, using sequences of events generated for the plurality of trigger actions, a foundational language model to predict resultant events for a sequence of lead up events and classify whether the resultant events indicate malicious activity. The method may detect the malicious activity by applying the foundational language model on an input sequence of events.