Network Alert Enrichment via Process Identification Model
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security systems struggle to efficiently identify malicious processes executing on host computers, as they often rely on limited network-level analysis and lack the capability to pinpoint specific processes responsible for malicious activity.
Innovation Solution
A method involving the collection of communication event reports from security agents on host computers, generation of features from these reports, training of a model to identify process IDs based on communication activity characteristics, and application of this model to alert reports from network management devices to initiate protective actions against malicious processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network-level security analysis is used, then security coverage is improved, but the ability to identify specific malicious processes deteriorates
Solution Approach 1:
The patent segments security analysis into multiple layers: network-level analysis for broad security coverage and host-level process-level analysis for precise malicious process identification. Security agents collect both network communication events and local process information, enabling differentiated analysis at appropriate granularities.
Solution Approach 2:
The patent transitions from two-dimensional network-level analysis to three-dimensional analysis by adding the process execution dimension. By correlating network events with running processes, the system achieves process-level precision while maintaining network-level security coverage.
2Measurement precision
If machine learning model is trained on communication event features, then process identification accuracy is improved, but data collection and processing complexity increases
Solution Approach 1:
The patent performs preliminary feature extraction and model training during a training phase using historical communication event data. Once trained, the model can be applied to new events without requiring complex real-time processing, reducing operational complexity while maintaining high accuracy.
Solution Approach 2:
The machine learning model acts as an intermediary that simplifies the complex relationship between network communication events and malicious processes. Instead of directly analyzing all raw data, the model processes pre-extracted features to identify malicious processes accurately.
3Difficulty of detecting and measuring
If security agents collect detailed communication event reports from all host computers, then detection capability is improved, but system performance and resource consumption deteriorates
Solution Approach 1:
The patent applies local quality by having security agents selectively collect and analyze communication events based on local host characteristics and threat intelligence. Not all events are treated equally; the system prioritizes analysis based on risk assessment, improving detection effectiveness while reducing unnecessary processing.
Data Source
AI summary
A method, including collecting, during a time period from multiple computers, reports of events, each of the events including communication activity performed by a process having a respective ID and executing on one of the computers. Respective sets of features including characteristics of the activity are generated from the reports, and a model is trained for identifying, based on the features of one or more of the events, the ID of one of the processes performing the one or more of the events. An alert indicating malicious activity and referencing one or more reports of additional communication events performed by a given computer is received from a network management device, and the model is applied to the one or more reports so as to identify, on the given computer, a given ID of a given process responsible for the alert. Finally, a protective action is initiated for the given process.