Malicious Activity Detection Using Segmented Event Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity methods are inadequate for detecting malicious activities in non-isolated environments, as they rely on limited data analysis and lack advanced predictive capabilities.
Innovation Solution
A method and system that analyze object behavior in a non-isolated environment using a processor to generate internal events, apply signature-based rules, and feed these events to a trained machine-learning algorithm to determine if the activity is malicious, generating a report when the prediction outcome exceeds a threshold.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based rules are applied to detect malicious activities, then detection accuracy is improved, but the system complexity increases
Solution Approach 1:
The detection system is segmented into multiple independent components: event collection modules at individual hosts, a centralized analysis server, and machine learning algorithms. This segmentation allows the system to handle complexity through modular design while maintaining high detection accuracy through specialized processing at each level.
Solution Approach 2:
A machine learning algorithm acts as an intermediary between raw event data and detection decisions. The ML algorithm processes events from multiple hosts, applies learned patterns, and generates detection outcomes, thereby reducing the complexity of direct rule-based processing while improving accuracy.
2Adaptability or versatility
If multiple hosts are monitored in a non-isolated environment, then detection coverage is improved, but data processing complexity increases
Solution Approach 1:
The system segments data processing by host, with each host generating and transmitting only relevant event flows to the analysis server. This segmentation maintains comprehensive coverage across multiple hosts while reducing the processing burden on any single component.
Solution Approach 2:
The system extracts and transmits only the essential event flow data from each host to the analysis server, filtering out redundant information locally. This extraction approach maintains detection coverage while significantly reducing the volume of data requiring centralized processing.
3Speed
If real-time analysis is performed, then response speed is improved, but computational resources are consumed
Solution Approach 1:
The system performs preliminary actions by pre-processing events locally at each host and pre-training machine learning models before actual detection is needed. This allows real-time analysis at the central server without consuming excessive computational resources, as the heavy lifting is done in advance.
Solution Approach 2:
The system applies partial analysis by processing only the most relevant event attributes and using selective machine learning predictions rather than comprehensive analysis of all data. This approach maintains real-time response speed while reducing computational resource consumption.
Data Source
AI summary
A method and a system for detecting a malicious activity are provided. The method comprises: receiving, from a given host of the plurality of hosts, an event flow including data representative of events occurred at the given host; analyzing a given event sequence of the event flow to generate, for a given event thereof, a respective internal event; applying to the respective internal event, a plurality of signature-based rules to determine at least one internal state marker of the given host associated with the given event; feeding the respective internal state markers to a trained machine-learning algorithm (MLA) to determine a prediction outcome thereof of whether the given event sequence is associated with the malicious activity; in response to the prediction outcome exceeding a predetermined threshold, determining the given event sequence as being associated with the malicious activity; and generating a report including the prediction outcome.