Kernel-Based User Operation Detection from Application Call Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity measures are inadequate in managing insider risks, as they fail to effectively monitor and prevent damaging actions by users due to a lack of contextual understanding and computational inefficiency in tracking user operations.
Innovation Solution
Implement a local monitoring entity at a data processing system that uses a trained machine learning model to analyze sets of calls made by user space applications to software functions, determining specific operations without requiring user space hooks, and generating reports or influencing application functioning based on predefined security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If user space hooks are applied to monitor application calls, then security monitoring capability is improved, but device complexity increases due to multiple agents and kernel mode hooks
Solution Approach 1:
The patent extracts the monitoring function from complex user space hooks and kernel mode hooks, and implements it directly in the operating system kernel. This consolidation eliminates the need for multiple external agents and reduces system complexity while maintaining security monitoring capability.
Solution Approach 2:
The operating system kernel is enhanced to provide both core OS functions and security monitoring functions through a unified mechanism. The kernel's process management capabilities are extended to include automated security policy enforcement, making the system more efficient and less complex.
2Measurement precision
If call stack walking and code disassembly are used to analyze calls, then monitoring accuracy is improved, but computational cost increases due to multiple memory accesses
Solution Approach 1:
The patent collects call stack information and process data in advance during normal process execution and management. By preparing this data beforehand in the kernel, the system avoids costly real-time code disassembly and multiple memory accesses when security events need to be monitored.
Solution Approach 2:
The patent replaces the mechanical process of walking call stacks and disassembling code with a more efficient kernel-based information retrieval mechanism. The kernel maintains process data structures that provide the necessary monitoring information without requiring intensive computational analysis.
Data Source
AI summary
Methods are described for determining user operations at a data processing system. In one example, an agent is established at the data processing system that has access to data indicating, for each of multiple user space applications, an association between (i) a set of multiple calls by the user space application to one or more software functions and (ii) a specific operation of the user space application. A set of calls by a given user space application to one or more software functions is received by the agent. It is determined that the set of calls are characteristic of a specific operation of the given user space application by processing the set of calls based on the data. One or both of generating a report regarding the specific operation and influencing functioning of the given user space application are then performed.