Malicious Tool Action Detection via ML Anomaly Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware tools struggle to detect and protect against malicious actions performed by legitimate computing-system tools, as these tools often have high reputation scores and are critical for benign actions, making it difficult to quarantine or delete them.
Innovation Solution
A computer-implemented method that identifies computing-system tools capable of both benign and malicious actions, records their actions over time, analyzes them using machine learning methods like autoencoders and radial classifiers to determine anomalies, and initiates security actions when malicious behavior is detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anti-malware tools quarantine or delete applications, then malware detection effectiveness is improved, but legitimate system tools cannot be protected against malicious use
Solution Approach 1:
The patent segments the analysis from detecting the tool itself to detecting specific actions performed by the tool. Instead of treating the entire application as malicious or benign, the system analyzes individual actions separately, allowing legitimate system tools to be preserved while their malicious actions are detected and blocked.
Solution Approach 2:
The system dynamically adjusts its detection approach based on the specific action being performed. By using machine learning to analyze action patterns and deviations, the system adapts its detection sensitivity for different actions, allowing benign actions to proceed while blocking malicious ones, rather than using a static quarantine approach.
2Ease of operation
If system tools are preserved for benign actions, then system functionality is maintained, but malicious actions by these tools go undetected
Solution Approach 1:
The system implements feedback loops where actions are monitored, analyzed, and used to update detection models. The machine learning components continuously learn from observed action patterns, allowing the system to maintain system functionality while progressively improving detection of malicious actions through adaptive feedback mechanisms.
Solution Approach 2:
The patent introduces an intermediary analysis layer between the system tool and its actions. This intermediary uses machine learning to evaluate whether each action is benign or malicious, allowing legitimate system tools to operate while blocking harmful actions, thus mediating between system functionality and security protection.
3Measurement precision
If machine learning analysis is applied to all actions, then detection accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The system applies machine learning analysis selectively rather than uniformly to all actions. By focusing computational resources on actions that exhibit suspicious patterns or deviations from normal behavior, the system achieves high detection accuracy while minimizing unnecessary processing time for clearly benign actions.
Data Source
AI summary
A computer-implemented method for detecting and protecting against malicious use of legitimate computing-system tools may include (i) identifying a computing-system tool that can perform benign actions and malicious actions on a computing system, (ii) creating a set of recorded actions by recording actions performed by the computing-system tool on the computing system over a predetermined period of time, (iii) analyzing the set of recorded actions via a machine learning method that, for each action in the set of recorded actions, determines whether the action is anomalous compared to other actions in the set, (iv) classifying an action in the set of recorded actions as malicious based at least in part on determining that the action is anomalous, and (v) initiating, in response to classifying the action as malicious, a security action related to the action. Various other methods, systems, and computer-readable media are also disclosed.