Endpoint Malware Initial Execution Detection via Process Chain Tracing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems face challenges in identifying the initial execution point of a malicious attack on an endpoint client, as they often get overwhelmed by benign activities that precede the malicious execution, making it difficult to trace back to the root cause.
Innovation Solution
A method and system that analyze processes and their creations on an endpoint client to identify the initial execution of a malicious attack by tracing back through a sequence of process executions and creations, using a reputation service to classify processes and determine if they are malicious or benign, thereby isolating the first malicious execution from benign activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware detection systems monitor all process executions on an endpoint, then detection coverage is improved, but the ability to identify the initial execution point deteriorates due to overwhelming benign activities
Solution Approach 1:
The patent segments the attack chain into discrete process execution stages, tracking each process creation and execution event separately. By dividing the monitoring into individual process nodes that can be traced back through parent-child relationships, the system can isolate the initial execution point from the overwhelming sequence of benign and malicious events, thereby maintaining both comprehensive detection coverage and precise initial execution identification
Solution Approach 2:
The system performs preliminary tracking of all process executions and their relationships before the attack fully unfolds. By establishing the complete process execution chain and parent-child relationships in advance, the system can later trace back from any detected malicious process to its origin, enabling accurate identification of the initial execution point even amidst numerous subsequent benign activities
2Measurement precision
If the system traces back through all process executions to find the initial malicious execution, then identification accuracy is improved, but the time and computational resources required increase
Solution Approach 1:
The system performs preliminary action by continuously building and maintaining a database of process execution chains and parent-child relationships as processes execute. This pre-established structural information allows the system to perform rapid traceback operations when malware is detected, significantly reducing the time required to trace back to the initial execution point compared to analyzing all processes from scratch
Solution Approach 2:
The patent creates a simplified copy or model of the process execution hierarchy that captures the essential parent-child relationships and execution sequences. This modeled representation allows for efficient traversal and analysis without requiring examination of every raw system event, thereby reducing computational overhead and analysis time while maintaining identification accuracy
Data Source
AI summary
Computerized methods and systems determine an initial execution of an attack on an endpoint. An indicator of the attack is obtained by analysis of a first process on the endpoint. A sequence of processes that includes the first process associates the initial execution of the attack with the first process. Each respective process in the sequence of processes is created or executed by at least one of the initial execution or a process in the sequence of processes. The initial execution is identified based on linking from the first process to the initial execution through a combination of executions and creations of the processes in the sequence of processes.