Malware Source Identification via Event Graph Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data management systems struggle to identify and eradicate the source of malware attacks, particularly when malware remains latent and has not yet activated, leading to incomplete recovery and potential re-infection of devices.
Innovation Solution
The system employs event collection and directed acyclic graph (DAG) construction to track interactions and risk scores across connected computing devices, pruning non-anomalous nodes to identify high-risk entities and the root cause of the attack, allowing for targeted eradication measures such as deletion or password reset.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the system performs comprehensive event collection and graph analysis to identify latent malware sources, then the measurement precision of malware detection is improved, but the device complexity and computational resources required increase
Solution Approach 1:
The system segments the malware detection process into distinct components: event collection module, graph construction module, anomaly detection module, and eradication module. Each module handles a specific aspect of the detection workflow, processing event data independently and passing results along the chain. This segmentation reduces overall system complexity by making each component manageable and independently optimizable.
Solution Approach 2:
The patent introduces an intermediary graph structure that mediates between raw event data and malware detection conclusions. The graph serves as an intermediate representation that organizes event relationships in a structured format, allowing complex interactions to be analyzed systematically. This intermediary layer simplifies the detection logic by providing a standardized framework for analyzing event sequences and relationships.
2Productivity
If the system restores infected devices to pre-activation states without identifying the source, then the productivity of recovery operations is improved, but the reliability of the system deteriorates due to potential re-infection
Solution Approach 1:
The system performs preliminary identification of the malware source and affected devices before executing recovery operations. By using graph analysis to trace event relationships and identify the origin of the infection, the system prepares a targeted eradication plan in advance. This preliminary action ensures that recovery operations address the root cause rather than just symptoms, preventing re-infection while maintaining efficient recovery processes.
Solution Approach 2:
The system implements feedback mechanisms where detection results from graph analysis inform and adjust the eradication strategy. The anomaly detection module continuously monitors the graph structure and event patterns, providing feedback that refines the identification of infected devices and the effectiveness of eradication measures. This feedback loop ensures reliable elimination of malware while maintaining productive recovery operations.
Data Source
AI summary
Methods, systems, and devices for data management are described. A system supporting malware detection may obtain event data such as risk scores corresponding to events associated with a set of computing entities. Using the event data, the system may construct a graph that includes nodes that represent the set of computing entities, and edges that represent the events, where the edges are between initiator and affected nodes and are associated with the respective event risk scores. Using the graph, respective node risk scores may be calculated for at least some nodes of the graph, and one or more anomalous nodes may be identified based on the one or more anomalous nodes having respective node risk scores that satisfy a threshold. The system may then output an indication of one or more computing entities corresponding to the one or more anomalous nodes.