Malicious Software Identification via Behavioral Analytics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer security technologies face challenges such as high false positives, complex management, unacceptable performance load, and lack of automatic responses, making them ineffective against polymorphic attacks and zero-day threats, and requiring human intervention for attack identification and response, which is costly and time-consuming.
Innovation Solution
A system and method that intercept and analyze first and second tier calls between the CPU and Kernel/OS, using a low-level data collector and Kernel modules to store call IDs, which are then mapped to a rulebase for threat analysis, enabling real-time identification and disruption of malicious behavior through an Analytic Engine and Management Module.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection methods are used to identify malware, then detection accuracy for known threats is improved, but the system becomes ineffective against polymorphic attacks and zero-day threats
Solution Approach 1:
The system segments malware detection into two independent layers: signature-based detection for known threats and behavioral analysis for unknown threats. The behavioral analysis layer further segments monitoring into multiple tiers (Tier 1 hardware events, Tier 2 system calls, Tier 3 application logs) that can be independently configured and analyzed, allowing the system to maintain high detection accuracy for known threats while adapting to new polymorphic and zero-day threats through behavioral patterns.
Solution Approach 2:
The system creates a universal detection framework that combines multiple detection methodologies (signature-based, behavioral analysis, hardware event monitoring) into a single platform. The behavioral analysis engine serves multiple functions: detecting known malware through pattern matching, identifying unknown threats through anomaly detection, and providing forensic analysis capabilities, thereby achieving both precision for known threats and adaptability for new threats.
2Reliability
If fully virtualized security systems are deployed to better identify behavior patterns, then threat detection capability is improved, but performance impact becomes unacceptable
Solution Approach 1:
Instead of implementing full virtualization of the operating system, the system applies partial virtualization only to the security monitoring functions. It virtualizes specific subsystems responsible for behavioral analysis and threat detection while leaving the core operating system and application performance paths unchanged. This selective approach provides sufficient threat detection capability without imposing the heavy performance overhead of complete system virtualization.
Solution Approach 2:
The system introduces a lightweight intermediary layer that sits between the hardware and the operating system, capturing behavioral data through hooks and filters without requiring full virtualization. This intermediary layer collects Tier 1 hardware events, Tier 2 system calls, and Tier 3 application logs, then passes them to the behavioral analysis engine for processing, thereby improving threat detection while minimizing performance impact on the host system.
3Measurement precision
If comprehensive data acquisition and process intermediation are implemented, then behavior pattern identification is improved, but performance load becomes unacceptable
Solution Approach 1:
The system applies different levels of monitoring granularity to different parts of the system based on their security criticality. Tier 1 hardware events and Tier 2 system calls receive intensive monitoring for high-value security operations, while less critical operations use lighter monitoring. This localized approach to data acquisition precision ensures adequate behavior pattern identification for security-critical functions while reducing overall performance load.
Solution Approach 2:
The system implements partial data acquisition by selectively monitoring only the most relevant behavioral indicators rather than capturing all system events. It focuses on collecting Tier 1 hardware events, Tier 2 system calls, and Tier 3 application logs that are most indicative of malicious behavior, filtering out redundant data. This selective monitoring achieves sufficient behavior pattern identification while minimizing the performance load of comprehensive data collection.
4Extent of automation
If security systems operate as fully virtualized environments, then automatic response capability is improved, but complexity of management increases
Solution Approach 1:
The system segments the security architecture into distinct modular components: data collection modules for gathering behavioral data, analysis engines for processing Tier 1-3 events and generating threat assessments, and automated response modules for executing countermeasures. Each module operates semi-independently with well-defined interfaces, enabling automatic response capability while simplifying management through clear separation of concerns and standardized integration points.
Data Source
AI summary
A security system and method secures and responds to security threats in a computer having a CPU, a Kernel/OS, and software applications. A low-level data collector intercepts a selection of first tier calls between the CPU and Kernel/OS, and stores associated first tier call IDs. A Kernel module intercepts a selection of second tier calls between applications and the Kernel/OS, and stores associated second tier call IDs. An Analytic Engine maps the stored first and second tier call IDs to a rulebase containing patterns of security threats, to generate a threat analysis, and then responds to the threat analysis. The Analytic Engine enlarges or contracts the selection of first and second tier calls to increase or decrease specificity of the threat analysis. A Management Module generates user interfaces accessible remotely by a user device, to update the rulebase and configure the low-level collector, the Kernel module, and the Analytic Engine.