Host Performance Analytics for Cyberattack Signature Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cyberattack detection methods focus on network-level analysis, missing sophisticated attacks that compromise host computer systems undetected, allowing data theft or disruption.
Innovation Solution
Analyze internal host system performance patterns using host-level data analytics to establish a baseline, identify discriminative indicators, and create cyberattack signatures through statistical methods like logistic regression, enabling timely detection of cyberattacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network-level analysis is used for cyberattack detection, then network traffic can be monitored, but sophisticated attacks that compromise host systems remain undetected
Solution Approach 1:
The patent transitions from network-level analysis to host-level analysis, adding a new dimension of observation. By monitoring internal host performance parameters (CPU usage, memory consumption, disk I/O, network activity) rather than only external network traffic, the system detects sophisticated attacks that operate within the host environment without leaving detectable network footprints.
2Reliability
If host-level data analytics are implemented, then internal system performance patterns can be analyzed to detect attacks, but system complexity increases
Solution Approach 1:
The patent segments the host system into multiple monitored components (CPU, memory, disk, network) and analyzes each separately. This segmentation allows complex host-level data to be processed in manageable units, with each component's performance parameters collected and analyzed independently before integrating findings for attack detection.
Solution Approach 2:
The patent establishes baseline performance parameters for each host component during normal operation before attacks occur. These pre-collected baselines enable subsequent anomaly detection by comparing real-time performance against expected ranges, reducing the need for complex real-time analysis during attack events.
3Object-affected harmful factors
If conventional network-level defenses are used, then network traffic can be blocked, but attacks can sneak past defenses and remain undetected for extended periods
Solution Approach 1:
The patent implements continuous monitoring of host performance parameters throughout the entire attack lifecycle. By continuously collecting and analyzing internal system data rather than relying on periodic network checks, the system maintains constant vigilance and can detect attacks at any stage, from initial compromise to data exfiltration, eliminating detection time losses.
Data Source
AI summary
A host computer system can be monitored to track its system performance data with respect to internal system parameters, and this monitoring can be performed when the host computer system is known to be under a cyberattack and when it is known to not be under the cyberattack. The system performance data for the host in these conditions can be comparatively analyzed by host level data analytics to find a subset of the internal system parameters and their corresponding data values that discriminatively correlate to the cyberattack. From this information, a cyberattack signature can be generated. The host system can thereafter be monitored based on its system performance data to determine whether this system performance data matches the cyberattack signature to support determinations as to whether the host is under cyberattack.