ML Model Detects Malicious Upload Activity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in detecting malicious upload activity at client devices, particularly by non-malware that uses legitimate processes to perform unauthorized uploads, making it difficult for anti-malware applications to detect due to limited or no signatures.
Innovation Solution
Generating training data to train a machine learning model using information about upload activity characteristics at client devices, including amounts of data, upload locations, data categories, and upload frequencies, to differentiate between malicious and non-malicious upload activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anti-malware applications use signature-based detection methods, then they can detect known malware, but they fail to detect non-malware that uses legitimate processes to perform malicious uploads
Solution Approach 1:
The patent changes the detection parameters from static malware signatures to dynamic behavioral parameters including upload amount, upload frequency, upload timing, and destination characteristics. This allows the system to detect malware based on its operational behavior rather than predefined signatures, enabling detection of previously unknown malware variants that exhibit suspicious upload patterns
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a machine learning-based analytical system. The machine learning model processes multiple behavioral parameters simultaneously and identifies complex patterns that indicate malicious activity, substituting rule-based detection with intelligent pattern recognition that adapts to new threat types
2Measurement precision
If anti-malware applications monitor detailed upload activity characteristics, then they can improve detection accuracy, but this increases system complexity and computational resources required
Solution Approach 1:
The patent segments the detection system into distinct functional modules: data collection module that gathers upload characteristics, feature extraction module that processes raw data, and machine learning model that performs classification. This modular segmentation reduces overall system complexity by assigning specific tasks to each component while maintaining high detection precision through coordinated operation of all modules
Solution Approach 2:
The patent introduces a machine learning model as an intermediary between raw upload activity data and detection decisions. This intermediary processes and interprets complex behavioral patterns, transforming detailed measurement data into actionable security decisions without requiring complex rule-based logic in the rest of the system
3Reliability
If the system collects comprehensive upload activity data including amounts, locations, categories, and frequencies, then it can differentiate malicious from non-malicious activity, but this increases data processing requirements
Solution Approach 1:
The patent performs preliminary processing of upload activity data by organizing and structuring it according to specific categories (amount, frequency, timing, destination) before feeding it to the machine learning model. This preliminary organization reduces the computational burden during the actual detection phase by presenting pre-processed, structured data that requires less intensive processing
Data Source
AI summary
A method for training a machine learning model using information pertaining to characteristics of upload activity performed at one or more client devices includes generating first training input including (i) information identifying, for each of the application categories, a frequency of upload activity that corresponds to uploading first amounts of data during a specified time interval. The method includes generating a first target output that indicates whether the frequency of upload activity that corresponds to uploading the first amounts of data corresponds to malicious or non-malicious upload activity. The method includes providing the training data to train the machine learning model on (i) a set of training inputs including the first training input, and (ii) a set of target outputs including the first target output.