Function Call Sequence Compression for Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively detect and mitigate anomalous sequences of function calls, which can indicate malicious attacks or software faults, leading to application crashes and security vulnerabilities.
Innovation Solution
The implementation of a method that compresses sequences of function calls using a compression model to identify anomalies, employing algorithms like probabilistic anomaly detection (PAD) and one-class support vector machines (OCSVM), and utilizing selective transactional emulation (STEM) for recovery and mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If compression models are used to detect anomalous function call sequences, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent introduces a compression model as an intermediary component that mediates between the function call sequence data and the anomaly detection process. The compression model (e.g., Lempel-Ziv, Context-Tree Weighting) acts as a mediator that transforms raw function call sequences into compressed representations, enabling accurate anomaly detection without requiring complex analysis of the original sequences directly.
Solution Approach 2:
The patent replaces traditional mechanical anomaly detection methods (rule-based systems, signature matching) with information-theoretic approaches using compression models. Instead of manually configured detection mechanisms, the system uses automated compression algorithms to infer anomalies based on the statistical properties of function call sequences, reducing manual configuration complexity while maintaining high detection accuracy.
2Loss of time
If real-time anomaly detection is implemented, then security response time is improved, but processing overhead increases
Solution Approach 1:
The patent performs preliminary actions by pre-computing compression models during a training phase using normal function call sequences. These pre-trained models are then reused during runtime for rapid anomaly detection without requiring intensive real-time computation. The system prepares detection capabilities in advance, allowing fast response to anomalies when they occur.
Solution Approach 2:
The patent changes the parameters of the detection process by using compression ratios as the key metric for anomaly detection. Instead of analyzing individual function call parameters or maintaining complex state information, the system monitors the compression ratio of incoming function call sequences against the pre-trained model, enabling low-overhead real-time detection.
3Reliability
If comprehensive function call monitoring is performed, then detection coverage is improved, but performance impact increases
Solution Approach 1:
The patent extracts only the essential information needed for anomaly detection by monitoring function call sequences at a high level. Instead of capturing complete application state, memory contents, or detailed execution traces, the system extracts and monitors only the sequence of function calls, which provides sufficient detection coverage while minimizing performance overhead.
Solution Approach 2:
The patent applies partial monitoring by focusing on the function call sequence rather than comprehensive application behavior analysis. This partial action approach provides adequate detection coverage for anomalies while avoiding the excessive performance cost of full application instrumentation and monitoring.
Data Source
AI summary
Methods, media, and systems for detecting an anomalous sequence of function calls are provided. The methods can include compressing a sequence of function calls made by the execution of a program using a compression model; and determining the presence of an anomalous sequence of function calls in the sequence of function calls based on the extent to which the sequence of function calls is compressed. The methods can further include executing at least one known program; observing at least one sequence of function calls made by the execution of the at least one known program; assigning each type of function call in the at least one sequence of function calls made by the at least one known program a unique identifier; and creating at least part of the compression model by recording at least one sequence of unique identifiers.