Malware Detection via Security Event Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-malware systems face challenges in accurately detecting malware infections due to false alarms caused by benign activities, leading to noise that obscures malicious notifications, resulting in incorrect classification and missed threats.
Innovation Solution
The system determines correlations between security events and malware infections on a group of endpoint devices to identify likely infections on a target device, using probabilistic classification and distinguishing between pre- and post-infection events to enhance detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-malware systems generate notifications for suspicious activities, then security monitoring coverage is improved, but false alarm rate increases due to benign activities being misclassified as malicious
Solution Approach 1:
The system segments the analysis by distinguishing between pre-infection and post-infection security events. Pre-infection events indicate susceptibility to malware types, while post-infection events confirm actual infections. This segmentation allows the system to differentiate between benign activities and actual threats, reducing false alarms while maintaining comprehensive monitoring coverage.
Solution Approach 2:
The system implements feedback mechanisms by continuously learning from security events across multiple endpoint devices. By analyzing patterns of security events and their correlations with malware infections, the system refines its detection algorithms over time, improving accuracy while maintaining broad monitoring coverage. The feedback loop helps distinguish between benign and malicious activities through iterative learning.
2Measurement precision
If traditional systems ignore notifications about benign activities to avoid false alarms, then false alarm rate decreases, but actual malware threats may be missed
Solution Approach 1:
The system performs preliminary analysis by identifying pre-infection security events that indicate an endpoint's susceptibility to specific malware types before actual infection occurs. This preliminary action allows the system to prepare targeted detection measures and distinguish between benign pre-infection activities and genuine threats, ensuring comprehensive threat detection while reducing false alarms from normal benign activities.
Data Source
AI summary
The disclosed computer-implemented method for determining types of malware infections on computing devices may include (1) identifying multiple types of security events generated by a group of endpoint devices that describe suspicious activities on the endpoint devices, each of the endpoint devices having one or more types of malware infections, (2) determining correlations between each type of security event generated by the group of endpoint devices and each type of malware infection within the group of endpoint devices, (3) identifying a set of security events generated on a target endpoint device that potentially has a malware infection, and (4) detecting, based on both the set of security events generated on the target endpoint device and the correlations between the types of malware infections and the types of security events, at least one type of malware infection likely present on the target endpoint device.