Malware Process Injection Detection via Protocol Fingerprint Anomalies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware process injection techniques evade detection by traditional antivirus and security tools, complicating the task for Extended Detection and Response (XDR) systems due to misleading effects on machine-learned models and AI-based solutions, making it difficult to identify and mitigate the threat.
Innovation Solution
Fusing endpoint and network metadata to create a core dataset, using anomaly detection to identify abnormal network activity, and generating behavior models to detect malware process injection, with remedial actions upon detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus and security tools are used for detection, then the detection method is simple and widely compatible, but the detection capability against process injection malware is insufficient
Solution Approach 1:
The patent combines endpoint metadata and network metadata into a unified core dataset, merging multiple data sources to improve detection capability. This integration allows the system to correlate process information with network activity, enabling detection of process injection attacks that would be invisible to traditional single-source detection tools.
Solution Approach 2:
The patent introduces behavioral modeling as an additional dimension to traditional signature-based detection. By creating behavior models that capture normal process characteristics and comparing actual process behavior against these models, the system adds a temporal and behavioral dimension to detection, enabling identification of anomalies indicative of process injection.
2Reliability
If machine-learned models and AI-based solutions are deployed in XDR systems, then the detection coverage is enhanced, but the models are misled by process injection and detection accuracy deteriorates
Solution Approach 1:
The patent introduces behavior models as an intermediary layer between the raw metadata and the machine-learned models. These behavior models process and normalize the metadata, creating a cleaned representation that is less susceptible to poisoning. The behavior models act as a filter that prevents maliciously injected processes from directly corrupting the training data or misleading the AI models.
Solution Approach 2:
The system performs preliminary analysis by creating behavior models that establish baseline characteristics of normal processes before the machine-learned models make detection decisions. This preliminary action of modeling expected behavior allows the system to identify deviations caused by process injection attacks, preventing the poisoned data from directly affecting the final detection outcome.
3Measurement precision
If endpoint and network metadata are fused to create a core dataset, then the detection precision is improved, but the data processing complexity increases
Solution Approach 1:
The patent segments the metadata fusion process into distinct components: endpoint metadata processing, network metadata processing, and correlation logic. By organizing the complex data fusion task into separate manageable segments with clear interfaces, the system achieves high detection precision while maintaining manageable processing complexity through modular architecture.
Data Source
AI summary
Techniques for detecting malware process injection on a host device. The techniques may include receiving endpoint metadata associated with an event, the endpoint metadata including information associated with a process that made a network connection from a host device. The techniques may also include receiving network metadata associated with the event, the network metadata including a network protocol fingerprint used to make the network connection. The techniques may further include determining that the network protocol fingerprint is indicative of a presence of malware process injection via the process running on the host device. Based on detecting the process of the malware process injection, an indication may be reported to a monitoring system and one or more remedial actions may be taken.