Graph-Based Malicious Activity Source Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing technologies struggle to effectively detect the source of malicious activity in computer systems, especially in targeted cyber-attacks and when antivirus software is not functioning.

Innovation Solution

A method and system that analyze the relations among objects in a computer system by forming a graph, selecting induced subgraphs, determining the coefficient of harmfulness, and identifying the source of malicious activity based on these analyses.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If resource-hungry analysis of system condition and behavior logs is performed to detect malicious activity, then detection effectiveness is improved, but labor expense and resource consumption increase significantly

Engineering Contradiction:
Improvedetection effectivenessVSAvoidresource consumption
Core Design Contradiction:
ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent segments the analysis by dividing system objects into groups and forming induced subgraphs from the system graph. Each subgraph represents a localized portion of the system that can be analyzed independently, reducing the overall computational burden while maintaining detection effectiveness through systematic examination of critical subsystems.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent transforms the detection problem from analyzing individual objects to analyzing relationships between objects through graph theory. By representing objects as vertices and relationships as edges, the system shifts from one-dimensional object inspection to multi-dimensional relational analysis, enabling more efficient pattern recognition of malicious activity.

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

2Measurement precision

If comprehensive analysis of system objects and their relations is performed to identify malicious sources, then detection accuracy is improved, but system complexity increases

Engineering Contradiction:
Improvedetection accuracyVSAvoidsystem complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent divides the complex system into manageable induced subgraphs, each representing a specific portion of the system with particular relationships. This segmentation allows the complex analysis task to be broken down into smaller, more tractable sub-tasks that can be processed systematically without overwhelming system complexity.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces graph theory as an intermediary framework between raw system data and detection conclusions. By using graphs to model and analyze relationships, the system gains a structured intermediate representation that simplifies the complexity of direct analysis while preserving the accuracy needed for precise malicious source identification.

Inventive Principle:
Principle #24Intermediary (Mediator)

3Reliability

If manual analysis methods are used to investigate malicious activity, then detection thoroughness is improved, but productivity decreases due to increased labor expense

Engineering Contradiction:
Improvedetection thoroughnessVSAvoidanalysis throughput
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The patent enables the system to perform automated analysis of induced subgraphs without requiring manual intervention for each examination. The system self-services by automatically computing coefficients of harmfulness, comparing subgraphs against known malicious patterns, and identifying suspicious objects, thereby maintaining thoroughness while dramatically improving productivity and reducing labor expenses.

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The patent replaces manual mechanical analysis with automated computational analysis. By substituting human analysts with an automated system that processes induced subgraphs and applies detection algorithms, the system maintains the thoroughness of comprehensive analysis while achieving much higher productivity and faster detection rates.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentEP3674943B1System and method of detecting a source of malicious activity in a computer system
Publication Date: 2025.03.05 AO KASPERSKY LAB
  • EP3674943B1 patent drawingFigure 1
  • EP3674943B1 patent drawingFigure 2
  • EP3674943B1 patent drawingFigure 3

AI summary

Disclosed herein are methods and systems for detecting a source of malicious activity in a computer system. An exemplary method comprises gathering information related to the objects of the computer system, forming a graph based on the information gathered on the objects, selecting at least two induced subgraphs (hereinafter, subgraph) from the resulting graph, determining the coefficient of harmfulness for each selected subgraph, the coefficient of harmfulness representing a numerical characteristic describing the strength of the relations between the vertices of that subgraph, determining, from the selected subgraphs, a subgraph whose coefficient of harmfulness is a minimum among the determined coefficients of harmfulness of the subgraphs, and the total coefficient of harmfulness of the subgraphs related to that subgraph is a maximum, identifying the object correlated with at least one vertex of the determined subgraph as a source of the malicious activity in the computer system.