Game Engine Security Sensors for Endpoint Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security solutions, including signature-based and AI-based methods, face challenges in effectively detecting and preventing malicious activities due to evolving threats and the need for continuous signature updates.
Innovation Solution
The use of game engine-based computer security systems, which leverage game engine architectures to implement security functions by monitoring operating system events, applying behavioral rules, and executing logical operations to detect and respond to security threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based security solutions are used to detect malicious files, then detection accuracy for known threats is improved, but the system becomes ineffective against evolving malware that automatically mutates
Solution Approach 1:
The patent transitions from signature-based detection (static parameter matching) to behavior-based detection (dynamic parameter monitoring). The system monitors multiple behavioral parameters such as file access patterns, process creation, registry modifications, and network connections to detect malware that mutates its signature but maintains malicious behavior patterns.
Solution Approach 2:
The system implements dynamic monitoring of process behavior and system state changes rather than static signature comparison. The game engine continuously observes and responds to changing system conditions, allowing detection of evolving threats through behavioral analysis rather than fixed signatures.
2Adaptability or versatility
If AI-based solutions are used to predict malicious files, then detection capability against unknown threats is improved, but the system requires sufficiently complete training data which is difficult to obtain
Solution Approach 1:
The system uses the operating system's own event logging and monitoring capabilities to generate behavioral data for detection, rather than requiring external training datasets. The game engine leverages existing system telemetry and event data to identify malicious patterns, eliminating the need for separate training data collection.
Solution Approach 2:
The patent introduces a game engine as an intermediary layer between the operating system and security analysis. This intermediary captures and structures system events into a standardized format that can be analyzed for malicious behavior patterns without requiring pre-trained AI models or extensive training data.
3Measurement precision
If traditional security monitoring systems are used to detect security threats, then detection of known malware signatures is improved, but the system lacks flexibility and extensibility for custom security rules
Solution Approach 1:
The security system is segmented into independent game engine components (sensors, logic controllers, actuators) that can be independently configured and extended. Each component handles specific security functions, allowing custom rules and detection logic to be added without affecting the entire system.
Solution Approach 2:
The game engine framework provides universal, reusable components that can serve multiple security detection purposes. The same sensor, logic controller, and actuator infrastructure supports both traditional signature-based detection and custom behavior-based detection, enabling a single system to handle multiple security scenarios.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A game engine sensor of a computing device executing an operating system receives first data from the operating system that represents occurrence of a monitored event. The game engine sensor sends second data corresponding to the monitored event to a game engine logic controller. A first logic block of the game engine logic controller determines, based on the second data and third data representing a system state of the computing device, that a first predicate condition is satisfied. A second logic block of the game engine logic controller determines, based on the second data and the third data, that a second predicate condition is satisfied. A computer security threat is detected based on the first and second predicate conditions being satisfied, and at least one game engine actuator is instructed to perform at least one action responsive to the computer security threat.