Graph-Based Malicious Activity Source Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies struggle to effectively detect the source of malicious activity in computer systems, especially in targeted cyber-attacks and when antivirus software is not functioning.
Innovation Solution
A method and system that analyze the relations among objects in a computer system by forming a graph, selecting induced subgraphs, determining the coefficient of harmfulness, and identifying the source of malicious activity based on these analyses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If resource-hungry analysis of system condition and behavior logs is performed to detect malicious activity, then detection effectiveness is improved, but labor expense and resource consumption increase significantly
Solution Approach 1:
The patent segments the analysis by dividing system objects into groups and forming induced subgraphs from the system graph. Each subgraph represents a localized portion of the system that can be analyzed independently, reducing the overall computational burden while maintaining detection effectiveness through systematic examination of critical subsystems.
Solution Approach 2:
The patent transforms the detection problem from analyzing individual objects to analyzing relationships between objects through graph theory. By representing objects as vertices and relationships as edges, the system shifts from one-dimensional object inspection to multi-dimensional relational analysis, enabling more efficient pattern recognition of malicious activity.
2Measurement precision
If comprehensive analysis of system objects and their relations is performed to identify malicious sources, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent divides the complex system into manageable induced subgraphs, each representing a specific portion of the system with particular relationships. This segmentation allows the complex analysis task to be broken down into smaller, more tractable sub-tasks that can be processed systematically without overwhelming system complexity.
Solution Approach 2:
The patent introduces graph theory as an intermediary framework between raw system data and detection conclusions. By using graphs to model and analyze relationships, the system gains a structured intermediate representation that simplifies the complexity of direct analysis while preserving the accuracy needed for precise malicious source identification.
3Reliability
If manual analysis methods are used to investigate malicious activity, then detection thoroughness is improved, but productivity decreases due to increased labor expense
Solution Approach 1:
The patent enables the system to perform automated analysis of induced subgraphs without requiring manual intervention for each examination. The system self-services by automatically computing coefficients of harmfulness, comparing subgraphs against known malicious patterns, and identifying suspicious objects, thereby maintaining thoroughness while dramatically improving productivity and reducing labor expenses.
Solution Approach 2:
The patent replaces manual mechanical analysis with automated computational analysis. By substituting human analysts with an automated system that processes induced subgraphs and applies detection algorithms, the system maintains the thoroughness of comprehensive analysis while achieving much higher productivity and faster detection rates.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are methods and systems for detecting a source of malicious activity in a computer system. An exemplary method comprises gathering information related to the objects of the computer system, forming a graph based on the information gathered on the objects, selecting at least two induced subgraphs (hereinafter, subgraph) from the resulting graph, determining the coefficient of harmfulness for each selected subgraph, the coefficient of harmfulness representing a numerical characteristic describing the strength of the relations between the vertices of that subgraph, determining, from the selected subgraphs, a subgraph whose coefficient of harmfulness is a minimum among the determined coefficients of harmfulness of the subgraphs, and the total coefficient of harmfulness of the subgraphs related to that subgraph is a maximum, identifying the object correlated with at least one vertex of the determined subgraph as a source of the malicious activity in the computer system.