Graph Convolution Network Anomaly Detection in Sandbox Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity systems face challenges in accurately identifying suspicious file behaviors in sandboxes, leading to false positives and the need for improved detection of borderline suspicious behaviors that do not harm the host system but are not typical in organizational networks.
Innovation Solution
The use of graph networks and machine learning (ML) with Graph Convolution Networks (GCN) to parse logs and generate heterogenous graphs, where node embeddings are calculated to score links as either existing or non-existing, allowing for real-time analysis of untagged files to determine benign or suspicious behavior based on predetermined thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hand-crafted security rules are used for anomaly detection, then detection coverage is achieved, but false positive rate increases
Solution Approach 1:
The patent replaces the mechanical rule-based system with a graph neural network-based machine learning system. Instead of manually crafted rules that generate false positives, the system uses GCN to automatically learn patterns from behavioral graphs, substituting manual rule-matching with automated neural network inference that generalizes better and reduces false alarms.
Solution Approach 2:
The patent transforms the detection approach by changing from discrete rule-based parameters to continuous embedding vectors. Behaviors are represented as node embeddings in a graph structure, allowing for nuanced similarity calculations and threshold-based detection that adapts to organizational norms, reducing false positives while maintaining detection coverage.
2Measurement precision
If complex rule-based systems are used to handle borderline cases, then detection precision improves, but system complexity increases
Solution Approach 1:
The patent introduces graph embeddings as an intermediary representation layer between raw behavioral data and detection decisions. Borderline cases are handled by computing similarity metrics in the embedding space, which provides a continuous spectrum of suspicion levels rather than binary rule matches, simplifying the decision process while improving precision for ambiguous cases.
3Ease of operation
If generic detection rules are used across organizations, then deployment ease is improved, but detection effectiveness for specific organizations decreases
Solution Approach 1:
The patent implements a preliminary training phase where the graph neural network learns from organizational-specific behavioral logs before deployment. This pre-training on private network data allows the model to adapt to organization-specific norms and patterns, ensuring both ease of deployment and high detection effectiveness for each organization's unique environment.
Solution Approach 2:
The patent enables each organization to have customized detection models trained on their own behavioral data, allowing local adaptation of detection sensitivity and patterns. Each organization's sandbox generates its own training data, creating locally optimized detection capabilities while maintaining a unified technical platform.
Data Source
AI summary
An ML (machine learning) training logs are parsed for generating a set of heterogenous graphs having embedded nodes connected with edges determined with link prediction and denoting a hierarchical relationship between nodes. Each graph represents benign behavior from executing one of the files of a training database in the sandbox, wherein the nodes are embedded in the graph using GCN (graph convolution network) to calculate a real-valued vector with fixed dimension. A runtime module to receive an untagged file in real-time for analysis from a network component, and generates a graph of runtime behavior from sandbox of the suspicious file for comparison against the training graphs.