Intrusion Detection via Selective Event Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional intrusion detection systems face challenges such as excessive alerts, high computational overhead, rigid or flexible rule sets, and inability to detect new malicious attacks, requiring significant expertise and resource burdens, and often fail to manage authorized updates effectively.
Innovation Solution
A computer-implemented method that intercepts a subset of events from a client machine's execution environment based on a learned security policy, identifying anomalies and executing mitigation actions, with automatic learning and extensible security policies that adapt to changes, reducing computational overhead and allowing authorized updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional intrusion detection systems monitor all events, then detection completeness is improved, but computational overhead increases excessively
Solution Approach 1:
The patent segments event monitoring into two categories: intercepted events (selected subset) and non-intercepted events (remaining events). The security agent intercepts only the selected subset of events for analysis, while other events continue without interception overhead. This segmentation resolves the contradiction by achieving detection of malicious events through selective monitoring rather than comprehensive monitoring of all events.
Solution Approach 2:
The patent applies partial action by intercepting only a selected subset of events rather than all events. The system determines that intercepting a specific portion of events (those relevant to malicious code detection) is sufficient to achieve effective intrusion detection without the excessive computational cost of monitoring every event generated by the execution environment.
2Measurement precision
If rigid rule sets are used for intrusion detection, then false positives are reduced, but ability to detect new malicious attacks decreases
Solution Approach 1:
The patent implements dynamic security policies that can be updated without requiring system restart or complex reconfiguration. The security agent loads updated security policies from storage and continues operation with the new policies, enabling the system to adapt to new attack patterns while maintaining operational stability. This dynamic capability allows the system to balance precision with adaptability.
Solution Approach 2:
The patent enables parameter changes in security policies through structured update mechanisms. Security policies contain configurable parameters that can be modified to reflect new threat intelligence or attack patterns. The system allows these parameters to be changed and applied without disrupting system operation, thereby improving detection of new attacks while maintaining policy structure and reducing false positives.
3Measurement precision
If comprehensive event interception is implemented, then intrusion detection accuracy is improved, but system performance degrades
Solution Approach 1:
The patent segments the event stream into intercepted and non-intercepted portions based on security policy criteria. By intercepting only the selected subset of events that are relevant to intrusion detection, the system maintains high detection accuracy for malicious activities while avoiding the performance degradation that would result from intercepting and analyzing every single event.
4Adaptability or versatility
If frequent security policy updates are applied, then adaptability to new threats is improved, but system stability decreases
Solution Approach 1:
The patent implements a dynamic policy update mechanism that allows security policies to be modified and applied during system operation. The security agent can load new security policies from storage and apply them without requiring system restart or complex reconfiguration. This dynamic capability enables frequent policy updates to respond to new threats while maintaining system stability through controlled application of changes.
Data Source
AI summary
A security manager configured to generate a plurality of learned security policies and provide at least one learned security policy and a security agent to a client machine for enforcement of the at least one learned security policy by the security agent on the client machine. The security manager configured to receive alerts from the security agent indicating anomalous behavior on the client machine.