Malware Detection via Behavioral Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems lack an integrated view across multiple enterprise systems, such as database access monitoring, file access monitoring, and network access monitoring, making it difficult to detect and respond to combined attacks that involve data leakage from multiple phases, and may fail to detect unknown malware based on behavioral features.
Innovation Solution
A processor that tracks events from multiple activity monitors, extracts network, database, and file behavioral features, and uses a malware identification model trained on private and public data to detect malware attacks, enabling dynamic ad hoc protection improvements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If malware detection systems use separate monitoring systems for different enterprise systems (database access monitoring, file access monitoring, network access monitoring), then each monitoring system can be specialized and simple to operate, but the systems cannot provide an integrated view to detect combined attacks that involve data leakage from multiple phases
Solution Approach 1:
The patent combines multiple separate monitoring systems (database access monitoring, file access monitoring, network access monitoring) into a unified malware detection system that processes events from all sources. The system merges these monitoring capabilities to provide an integrated view of enterprise data flows, enabling detection of combined attacks that span multiple phases while maintaining the specialized functionality of each monitoring component through modular event processing.
2Measurement precision
If malware detection systems rely on traditional signature-based methods, then they can detect known malware with high accuracy, but they fail to detect unknown malware based on behavioral features
Solution Approach 1:
The patent transitions from traditional signature-based detection to behavior-based detection by changing the detection parameters from static malware signatures to dynamic behavioral features. The system extracts behavioral features from events (such as access patterns, data flow characteristics, and temporal sequences) and uses machine learning models to detect both known and unknown malware based on these behavioral parameters, thereby improving adaptability while maintaining detection accuracy through sophisticated analysis.
3Adaptability or versatility
If the system integrates multiple monitoring sources and uses machine learning models, then it can detect a wider range of malware attacks including unknown ones, but the system complexity increases
Solution Approach 1:
The patent segments the complex malware detection system into distinct modular components: event collection modules for different monitoring sources, event normalization and processing modules, behavioral feature extraction modules, and machine learning model modules. This segmentation allows the system to handle multiple monitoring sources and complex machine learning analysis while maintaining manageable complexity through clear separation of concerns and independent, reusable components.
4Speed
If the system processes events from multiple activity monitors in real-time, then it can provide timely detection and response, but the processing requirements and resource consumption increase
Solution Approach 1:
The patent extracts and focuses only on the most relevant behavioral features from the raw events collected by multiple activity monitors, rather than processing all event data in full detail. By selecting and extracting key behavioral indicators (such as access frequency, data volume patterns, and temporal characteristics), the system achieves timely real-time detection while reducing processing requirements and resource consumption by filtering out less significant data.
Data Source
AI summary
Detecting malware attacks is described herein. A computer-implemented method may include receiving, via a processor, events from a plurality of activity monitors. The method also include extracting, via the processor, a plurality of behavioral features from the received events. The method may further include detecting, via the processor, a malware attack based on the extracted behavioral features using a malware identification model trained on private data and public data using a machine learning technique, wherein the private data includes private enterprise attack findings. The method may also include executing, via the processor, an ad hoc protection improvement based on the detected malware attack.