Holo-entropy alarm scoring for VM false positives
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems for virtual machine environments, such as AppDefense, face challenges in determining the optimal duration for discovery mode, leading to false positive alarms and unclear severity of alerts due to changes in the system, like OS updates or new software, which can create harmless events not detected during the discovery period.
Innovation Solution
Implementing a holo-entropy based scoring approach to manage alarms by receiving alarm data, storing it, and comparing features to intended state information to determine outliers, computing scores for normal or abnormal alarms, and sending notifications with the computed scores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If discovery mode is extended to detect more events, then detection coverage is improved, but false positive alarms increase due to system changes like OS updates and new software
Solution Approach 1:
The system performs preliminary learning of process behavior patterns during a discovery mode phase before entering protected mode. This preliminary action establishes a baseline of normal behavior that enables the system to distinguish between legitimate system changes (like OS updates) and actual threats, thereby improving detection coverage while reducing false positives.
Solution Approach 2:
The system dynamically adjusts the discovery mode duration based on entropy calculations. When entropy (measure of behavior variability) falls below a threshold, indicating sufficient learning, the system automatically transitions from discovery to protected mode. This parameter change optimizes detection coverage while preventing false alarms caused by extended discovery periods.
2Object-generated harmful factors
If discovery mode is shortened to reduce false positives, then false positive alarms decrease, but detection coverage is reduced and new harmless events are not detected
Solution Approach 1:
The system continuously monitors process behavior and calculates entropy to determine whether the discovery mode should continue or transition to protected mode. This feedback mechanism ensures the discovery mode lasts long enough to learn all legitimate events (including those from new software) while not extending so long as to create false positives, thus balancing both detection coverage and false positive reduction.
Solution Approach 2:
The discovery mode duration is not fixed but dynamically determined based on real-time entropy calculations. The system adapts the discovery period length to the specific environment's behavior patterns, allowing sufficient time to detect new harmless events while automatically transitioning when adequate coverage is achieved, thereby avoiding false positives.
3Ease of operation
If all alarms are treated equally, then simplicity is maintained, but severity differentiation is lost and critical issues cannot be prioritized
Solution Approach 1:
The system assigns different quality levels (severity scores) to different alarms based on their characteristics and deviation from learned behavior patterns. Critical alarms receive higher severity scores while less important alarms receive lower scores, enabling prioritized handling without complicating the basic alarm notification mechanism.
Solution Approach 2:
The alarm notification system uses asymmetric treatment based on entropy-based severity scoring. Instead of uniform notification, the system differentiates notification urgency and priority based on how significantly the alarm deviates from normal behavior, preserving simplicity while conveying critical severity information through the scoring mechanism.
Data Source
AI summary
A method for managing alarms in a virtual machine environment includes receiving alarm data related to a process and storing the alarm data in a database, where the alarm data comprises one or more features. The method further includes retrieving intended state information for the process and comparing the one more features of the alarm data to the intended state information to determine whether the alarm is an outlier. The method also includes computing a normal score for the alarm if the alarm is not an outlier, and computing an abnormal score for the alarm if the alarm is an outlier. The method also includes sending a notification for the alarm and the computed score.