Malicious Process Detection via Cross-Process Event Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security systems struggle to detect malicious processes that split their actions among multiple processes, making it difficult to categorize them as malicious, especially when they use trusted processes or child processes to accomplish malicious tasks.
Innovation Solution
A computer-implemented method that categorizes processes as malicious by comparing event data across multiple processes to identify malicious chains of events, involving storing event data, comparing new data with existing data to find common variables, and categorizing processes as malicious if a malicious chain is detected, even if the processes are uncategorized or trusted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional security systems examine only a single process's actions in isolation, then the system complexity remains low, but the detection accuracy of malicious processes that split actions among multiple processes deteriorates
Solution Approach 1:
The patent segments the analysis of malicious behavior by dividing it into individual process-level event sequences. Each process is analyzed separately for its own chain of events, while the novelty lies in correlating these segmented analyses across multiple processes to detect coordinated malicious activity that spans process boundaries.
Solution Approach 2:
The patent merges the event data from multiple independent process analyses into a unified detection framework. By combining event sequences from different processes and identifying correlations between them, the system detects malicious chains of events that span across multiple processes, thereby improving detection accuracy without requiring complete reanalysis of all system events.
2Reliability
If security systems track every event initiated by unknown processes, then the monitoring completeness improves, but the processing time and computational resources increase
Solution Approach 1:
The patent extracts only the relevant event sequences from the complete set of tracked events. By identifying and focusing on specific event types that are indicative of malicious behavior chains, the system reduces the volume of data requiring intensive processing while maintaining monitoring completeness for suspicious activities.
Solution Approach 2:
The patent performs preliminary filtering and categorization of events as they are tracked, organizing them into process-specific event sequences before correlation analysis. This preliminary structuring of data reduces the computational burden during the correlation phase, as the system only needs to compare pre-organized event sequences rather than raw event streams.
3Adaptability or versatility
If malware splits suspicious actions among multiple different processes, then the malware's ability to evade detection improves, but the difficulty of detecting the malicious chain increases
Solution Approach 1:
The patent implements a feedback mechanism where event sequences from multiple processes are continuously correlated and compared. When events from different processes exhibit correlating patterns consistent with a malicious chain, the system provides feedback to update detection rules and flag the coordinated activity, enabling detection of distributed malware behaviors that adapt to split across processes.
Data Source
AI summary
The disclosed computer-implemented method for categorizing processes as malicious may include (1) storing, in a security application that tracks event data for the computing device, data about an event triggered by an uncategorized process, (2) storing, in the security application, new data about an additional event triggered by an additional process that has not previously been determined to be connected to the uncategorized process, (3) comparing the new data about the additional event with the data about the event to determine whether the additional data shares a common variable with the data, (4) identifying, based on determining that the additional data shares the common variable with the data, a malicious chain of events that comprises the event and the additional event, and (5) categorizing the uncategorized process as malicious in response to identifying the malicious chain of events. Various other methods, systems, and computer-readable media are also disclosed.