Malicious Behavior Modeling Without User Presence
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting malicious behavior on computing devices in the absence of users is challenging due to background noise from benign activities, making it difficult to isolate suspicious behavior.
Innovation Solution
A system trains an anomaly detection model using events from clean machines when users are not present, filters out benign events from infected machines, and uses a classifier to identify predictive attributes for malware detection, allowing for monitoring and prediction of machine infection status.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anomaly detection model is trained on clean machine events to filter benign events, then detection precision improves, but system complexity increases
Solution Approach 1:
The system segments the detection process into distinct phases: training phase using clean machine events, filtering phase using anomaly detection models, and classification phase using trained classifiers. This segmentation allows each component to specialize in specific tasks, improving overall detection precision while managing complexity through modular architecture.
Solution Approach 2:
The system performs preliminary actions by pre-training anomaly detection models and classifiers using clean machine events before actual malware detection. This preliminary training establishes baseline behavior patterns, enabling the system to more accurately distinguish malicious events from benign activities during runtime, thereby improving detection precision.
2Measurement precision
If classifier identifies multiple attributes for malware prediction, then detection accuracy improves, but processing time increases
Solution Approach 1:
The system dynamically adjusts the set of monitored attributes based on the specific detection context and machine state. Rather than continuously monitoring all possible attributes, the system selectively activates monitoring for relevant parameters, maintaining detection accuracy while reducing processing overhead and time consumption.
Solution Approach 2:
The system applies different levels of attribute monitoring to different machines and event types based on local characteristics. High-risk machines or suspicious events receive more comprehensive attribute analysis, while low-risk systems use reduced monitoring, optimizing the balance between detection accuracy and processing time.
Data Source
AI summary
Systems, apparatuses, methods, and computer readable mediums for modeling malicious behavior that occurs in the absence of users. A system trains an anomaly detection model using attributes associated with a first plurality of events representing system activity on one or more clean machines when users are not present. Next, the system utilizes the trained anomaly detection model to remove benign events from a second plurality of events captured from infected machines when users are not present. Then, the system utilizes malicious events, from the second plurality of events, to train a classifier. Next, the classifier identifies a first set of attributes which are able to predict if an event is caused by malware with a predictive power greater than a threshold.