Malicious Behavior Detection via Event Pattern Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malware are time-consuming and resource-intensive due to the increasing obfuscation of malicious software, making it difficult to determine whether a program is malware or exhibiting malicious behavior.
Innovation Solution
A system and method for detecting malicious incidents by scoring, classifying, and ranking data associated with events on a monitored computing device, using a security agent that analyzes patterns in event data, adjusts scores based on frequency and additional information, and aggregates scores to determine if an incident indicating malicious behavior is occurring, with the ability to detect patterns across multiple devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware detection methods are used, then detection capability is maintained, but detection time and resource consumption increase significantly
Solution Approach 1:
The patent segments the malware detection process into multiple independent modules: event collection module, pattern matching module, scoring module, and decision module. Each module processes specific aspects of malware detection independently, enabling parallel processing and reducing overall detection time while maintaining accuracy through coordinated operation of specialized components.
Solution Approach 2:
The system performs preliminary actions by pre-defining patterns of legitimate and malicious behavior, pre-calculating scores for various event combinations, and establishing baseline statistics before actual malware detection occurs. This preparation enables rapid comparison and decision-making during real-time detection, significantly reducing response time without sacrificing detection accuracy.
2Measurement precision
If code disassembly is performed for malware analysis, then detection accuracy improves, but processing complexity and time increase
Solution Approach 1:
The patent replaces the mechanical/disassembly-based malware analysis approach with an event-pattern-based detection system. Instead of disassembling and analyzing code structure, the system monitors high-level events (file operations, registry changes, network activity) and matches them against predefined patterns, significantly reducing processing complexity while maintaining effective detection capability.
Solution Approach 2:
The patent introduces event data as an intermediary between the malware and the detection system. Rather than directly analyzing complex code structures, the system observes simplified event representations that capture malicious behavior characteristics, acting as a mediator that translates complex malware operations into detectable patterns without requiring code disassembly.
3Measurement precision
If more event data is collected and analyzed, then detection accuracy improves, but system resource consumption increases
Solution Approach 1:
The patent applies local quality by tailoring the depth and type of event analysis to the specific context and severity of detected events. Common or low-severity events are processed with minimal analysis, while rare or high-severity events trigger more intensive pattern matching and scoring. This differentiated processing approach maintains high detection accuracy for critical threats while reducing overall resource consumption through selective analysis intensity.
Solution Approach 2:
The system dynamically adjusts analysis parameters based on detected event characteristics, including the type of event, its frequency, its severity level, and contextual information. By changing parameters such as pattern matching depth, scoring thresholds, and data retention policies according to event properties, the system optimizes the balance between detection accuracy and resource consumption for each specific detection scenario.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Example techniques detect incidents based on events from or at monitored computing devices. A control unit can detect events of various types within a time interval and aggregate the detected events into an incident. The control unit can detect patterns within the events based at least in part on predetermined criterion. In examples, the control unit can determine pattern scores for the patterns based on the probability of occurrence for the patterns and determine a composite score based on the pattern scores. The control unit can determine that an incident indicating malicious activity has been detected based in part determining that the composite score is above a predetermined threshold score. In some examples, the control unit can classify and rank the incidents. The control unit can determine if an incident indicates malicious activity including malware or targeted attack.