Incident Score Mapping for Malicious Event Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious behavior in computer systems are time-consuming and resource-intensive due to the increasing obfuscation of malware, making it difficult to determine whether a program is malicious or not.
Innovation Solution
A system that monitors host devices for potential malicious incidents by aggregating incident scores based on patterns detected within a time interval, mapping these scores to a fixed range, and using an aggregation scheme to determine the severity of incidents, allowing for real-time detection and remedial actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware detection methods are used, then detection accuracy can be maintained for known malware, but detection becomes time-consuming and resource-intensive due to increasing malware obfuscation
Solution Approach 1:
The system performs preliminary actions by continuously monitoring and collecting event data from host devices, building a baseline of normal behavior patterns before actual malware detection is needed. This pre-positioning of detection capabilities allows for faster response when suspicious activity occurs, reducing detection time while maintaining accuracy through pre-established behavioral models
Solution Approach 2:
The patent replaces traditional signature-based mechanical detection methods with a behavior-based analytical system. Instead of matching known malware patterns, the system substitutes this approach with monitoring event sequences and detecting deviations from normal behavior, enabling detection of obfuscated malware without being constrained by known signatures, thus reducing time losses
2Measurement precision
If comprehensive monitoring of all events is performed, then detection precision is improved, but system complexity and resource consumption increase
Solution Approach 1:
The system extracts only the essential and relevant event data from the vast amount of generated events, focusing on specific event types that are most indicative of malicious behavior. By selectively extracting critical information rather than processing all events uniformly, the system maintains high detection precision while reducing the computational complexity and resource requirements
Solution Approach 2:
The patent applies local quality by implementing event importance weighting, where different events are assigned different levels of significance based on their relevance to malware detection. This allows the system to concentrate computational resources on analyzing high-importance events with greater precision while using lighter processing for low-importance events, thereby maintaining overall detection precision without uniformly increasing system complexity across all monitoring aspects
3Measurement precision
If detailed event analysis is performed for every incident, then detection accuracy is improved, but processing speed decreases
Solution Approach 1:
The system implements partial action by performing detailed event analysis only for incidents that exceed certain thresholds or exhibit suspicious characteristics. For routine or low-risk events, the system applies lighter processing. This selective approach ensures high detection accuracy for critical incidents while maintaining processing speed through reduced analysis intensity for less concerning events
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques and systems to provide a more intuitive user overview of events data by mapping unbounded incident scores to a fixed range and aggregating incident scores by different schemes. The system may detect possible malicious incidents associated with events processing on a host device. The events data may be gathered from events detected on the host device. The incident scores for incidents may be determined from the events data. The incident scores may be mapped to bins of a fixed range to highlight the significance of the incident scores. For instance, a first score mapped to a first bin may be insignificant while a second score mapped to a last bin may require urgent review. The incident scores may also be aggregated at different levels (e.g., host device, organization, industry, global, etc.) and at different time intervals to provide insights to the data.