Membership Query System for Cybersecurity Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity methods rely heavily on blacklisting and whitelisting, which require significant computer resources to store and process large volumes of known malware and good entities, and are ineffective in detecting novel or zero-day threats.
Innovation Solution
A membership query system that evaluates executable files by extracting representative patterns and determining membership through a learning mode and testing mode, using a membership function to classify files as known good or bad, and updating the membership signature efficiently, reducing resource consumption and enabling detection of novel entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blacklisting or whitelisting methods are used to detect known threats, then detection capability for known bad entities is improved, but computer resources required to store and process large volumes of data increase significantly
Solution Approach 1:
The patent extracts only the essential identifying features (signatures) of known good and bad entities rather than storing complete data sets. By taking out only the critical pattern recognition elements, the system maintains detection capability while dramatically reducing storage and processing resource requirements.
Solution Approach 2:
Instead of storing all known bad entities in a blacklist or all known good entities in a whitelist, the patent inverts the approach by storing compact representative patterns that can identify members of these sets through pattern matching, thereby reducing the quantity of stored data while maintaining detection effectiveness.
2Reliability
If blacklisting or whitelisting methods are used to detect known threats, then detection capability for known bad entities is improved, but ability to detect novel or zero-day threats remains ineffective
Solution Approach 1:
The system performs preliminary pattern extraction and membership signature creation during a learning phase before actual detection is needed. This preliminary action builds a foundation of representative patterns that enable the system to detect both known threats and novel entities by comparing new entities against these pre-established patterns.
Solution Approach 2:
The patent changes the parameter representation from complete entity data to compressed pattern signatures. By transforming the data representation parameters, the system achieves both efficient storage and the ability to generalize pattern matching to detect novel entities that share characteristic patterns with known entities.
3Reliability
If whitelist approach is used to allow known good entities, then security against known good entities is improved, but administrative complexity increases due to difficulty in maintaining the whitelist
Solution Approach 1:
The patent creates compact copy representations (pattern signatures) of known good entities that can be efficiently stored and processed. Instead of managing complete whitelist entries, the system uses compressed pattern copies that are easier to maintain and update while preserving the security function of identifying legitimate entities.
Data Source
AI summary
Disclosed is a method of evaluating membership in a membership set. The membership query system receives data to determine membership. A representative pattern is extracted from the data that may be of a predetermined length or of an arbitrary length. A learning mode of the membership query system defines the membership set as a membership signature. The membership query system then determines whether the representative pattern is a member of the membership signature by applying a membership function. In the context of cybersecurity, if the data is a member of a set of known good executable files, then the executable file may be allowed or installed. If the data is not a member of a set of known good executable files, then the file is flagged for further investigation.