Malicious Process Detection via Economic Inequality Indicators
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious processes are reactive and rely on human-defined lists, often failing to detect threats proactively until after they have caused harm.
Innovation Solution
A system and method that uses economic principles, such as the Herfindahl index and Gini coefficient, to analyze process paths and identify potential malicious activity by detecting inequality patterns, isolating processes that exceed predetermined thresholds, and relocating them to a quarantine for further examination.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If rules-based detection methods using human-defined lists are used, then detection accuracy for known threats is improved, but detection speed and responsiveness to new threats deteriorate
Solution Approach 1:
The system performs preliminary analysis of process paths and computes inequality indicators (Herfindahl index, Gini coefficient) in advance to establish baseline patterns of normal behavior. This allows the system to proactively detect deviations from normal patterns without waiting for threats to manifest or for manual rule updates, thereby reducing detection delay while maintaining accuracy through pre-computed reference data
Solution Approach 2:
The patent replaces the mechanical system of manual rule creation and updating with an automated economic analysis system that computes inequality indicators from process path data. This substitution eliminates the time-consuming human-in-the-loop process of defining and maintaining detection rules, enabling real-time detection of both known and unknown threats through automated pattern recognition based on economic principles
2Productivity
If proactive detection methods using economic principles are used, then detection speed and timeliness are improved, but system complexity increases
Solution Approach 1:
The system transforms complex process path analysis into simplified inequality indicators by changing the parameters from raw path data to economic metrics (Herfindahl index, Gini coefficient). This parameter transformation reduces system complexity by converting unstructured path information into standardized numerical values that can be quickly computed and compared against thresholds, thereby improving detection speed without requiring complex analysis algorithms
Solution Approach 2:
The patent introduces inequality indicators as intermediary variables between raw process path data and malicious process detection. These intermediaries simplify the detection system by serving as computationally efficient proxies that capture the essential characteristics of process behavior patterns, reducing the complexity of direct path analysis while maintaining detection effectiveness through threshold-based comparison
3Ease of manufacture
If reliance on predefined malicious process lists is maintained, then ease of implementation is improved, but adaptability to new threats deteriorates
Solution Approach 1:
The system enables self-service detection by automatically computing inequality indicators from process path data without requiring external rule definitions or updates. The system serves itself by using the collected path data to generate detection criteria dynamically, allowing it to adapt to new threats autonomously while maintaining ease of implementation through automated pattern recognition rather than manual rule creation
Solution Approach 2:
The patent transforms the static nature of predefined malicious process lists into a dynamic detection system where inequality indicators are continuously computed and updated based on observed process paths. This dynamic approach allows the system to automatically adapt to new threats by detecting deviations from learned normal patterns, providing versatility without sacrificing ease of implementation since the adaptation occurs automatically through economic analysis
Data Source
AI summary
Methods and systems for detecting malicious processes. Methods described herein gather data regarding process locations and calculate one or more inequality indicators related to the process paths based on economic principles. Instances of inequality with respect to process paths may indicate a path is uncommon and therefore the associated binary is used for malicious purposes.