Kernel Stack Trace Detection for Low-Overhead Threat Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods require resource-intensive synchronization and correlation of independently collected system events and stack traces, leading to inefficient operation of computing systems.
Innovation Solution
A system and method that utilizes kernel-level monitoring and machine learning models to synchronize system calls and stack traces, providing two levels of monitoring and analysis to efficiently detect threats with reduced resource utilization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If stack traces are collected independently from system events, then the collection process is simpler, but the analysis requires resource-intensive correlation and synchronization
Solution Approach 1:
The patent merges the collection of system events and stack traces into a unified kernel-level monitoring mechanism. The kernel sensor captures both system calls and stack traces simultaneously in a synchronized manner, eliminating the need for subsequent correlation operations. This integration is achieved through the kernel sensor that hooks into system calls and automatically captures stack traces when events of interest are detected, thereby resolving the contradiction between ease of collection and analysis efficiency.
Solution Approach 2:
The patent applies preliminary action by capturing stack traces at the moment system events are detected, rather than collecting them independently afterward. The kernel sensor proactively captures stack traces when specific system calls are detected, ensuring that the stack trace and system event are already synchronized and ready for analysis. This preliminary capture eliminates the need for resource-intensive post-collection correlation operations.
2Measurement precision
If full stack traces are captured for all processes, then threat detection accuracy is improved, but resource utilization increases
Solution Approach 1:
The patent applies local quality by capturing full stack traces only for specific processes or threads where events of interest are detected, rather than capturing stack traces for all processes uniformly. The kernel sensor monitors system calls and only triggers full stack trace capture when suspicious or relevant events are detected, thereby maintaining high detection accuracy for threats while reducing overall resource utilization for processes that do not exhibit suspicious behavior.
Solution Approach 2:
The patent applies partial action by selectively capturing stack traces only when necessary, rather than capturing all possible stack traces. The kernel sensor uses filtering mechanisms to identify events of interest and only captures full stack traces for those specific events, avoiding the excessive resource consumption that would result from capturing all stack traces regardless of relevance.
3Productivity
If system events and stack traces are collected independently, then collection overhead is reduced, but information completeness is lost
Solution Approach 1:
The patent merges the collection of system events and stack traces into a unified kernel-level monitoring mechanism. The kernel sensor captures both system calls and stack traces simultaneously in a synchronized manner, ensuring that no information is lost during collection. This integration is achieved through the kernel sensor that hooks into system calls and automatically captures stack traces when events of interest are detected, thereby resolving the contradiction between collection speed and information completeness.
Solution Approach 2:
The patent applies feedback by using the kernel sensor to continuously monitor system calls and dynamically determine when stack traces should be captured. The sensor provides feedback about system event characteristics to the capture mechanism, enabling intelligent decision-making about when to capture full stack traces. This feedback loop ensures that information completeness is maintained while avoiding unnecessary capture operations that would reduce collection efficiency.
Data Source
AI summary
A method and system for threat detection and analysis is disclosed herein. The method includes monitoring at least one thread associated with at least one process on a computing system. The method further includes detecting specific system calls associated with at least one process at kernel level. The specific system calls are analyzed by applying a filter to the system calls sequence feature set associated with the specific system calls for detecting one or more events of interest. A full stack trace capture of at least one process is requested if the system calls sequence feature set is filtered and the one or more events of interest are detected. A first level monitoring is provided to the computing system, which includes processing and analyzing the captured full stack trace by a machine learning (ML) stack trace analyzer to generate a first verdict for threat detection and analysis.