Network Security IOC Generation for Low-and-Slow Attack Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional computer network security systems, such as Endpoint Detection & Response (EDR) systems, face challenges in detecting and tracking 'low and slow' attacks, where attackers use persistence methods that are difficult to detect due to their infrequent activity and reliance on system noise, causing traditional methods like process tree tracking to break down across reboots.
Innovation Solution
A method and server configuration in a computer network security system that utilizes data collectors to monitor and analyze behavior across multiple nodes, generates new Indicators of Compromise (IOCs) based on suspicious activity, and automatically responds to security breaches by comparing behavior with IOC databases, enabling continuous tracking of attackers even after reboots and system shutdowns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional process tree tracking is used to monitor attacker activities, then detection of active attacks is possible, but tracking fails across reboots and system shutdowns
Solution Approach 1:
The patent transitions from process-based tracking (temporary, in-memory) to artifact-based tracking (persistent, stored on disk). By monitoring file system artifacts such as registry keys, scheduled tasks, and startup folders that survive reboots, the system extends tracking duration across system shutdowns while maintaining reliability through persistent evidence.
Solution Approach 2:
The system performs preliminary monitoring and collection of artifact data before reboots occur, storing this information in a manner that allows reconstruction of attacker activities after system restart. This enables continuous tracking across shutdowns by having evidence ready in advance.
2Measurement precision
If data collection frequency is increased to detect low and slow attacks, then detection capability improves, but system noise and false alarms increase
Solution Approach 1:
The patent extracts and monitors only specific artifact types that are indicative of persistence mechanisms (registry keys, scheduled tasks, startup items) rather than collecting all system events. This selective extraction reduces noise while maintaining precision for detecting low-and-slow attacks that use persistence hooks.
Solution Approach 2:
The system changes the monitoring parameters from frequent process tree snapshots to periodic artifact-based checks. By adjusting the monitoring frequency and type to match the persistence mechanism's update patterns, the system reduces false alarms while maintaining detection precision for actual threats.
3Loss of information
If comprehensive behavioral monitoring is implemented to track attackers over time, then situational awareness improves, but resource consumption and system complexity increase
Solution Approach 1:
The patent segments the monitoring system into distinct artifact type categories (registry, scheduled tasks, startup folders, services). Each segment monitors specific persistence mechanisms independently, reducing overall system complexity while maintaining comprehensive information collection through modular, organized tracking of different artifact types.
Data Source
AI summary
A method comprising: monitoring events collected from a plurality of network nodes; detecting a first suspicious event among the monitored events by a detection mechanism; monitoring the behaviour of the first suspicious event and any related events; in case the monitored first suspicious event and/or a related event is detected to perform an activity triggering an IOC (indicator of compromise, generating a new IOC; monitoring new events when the activity ends; comparing the behaviour of the new events with the behaviour of the generated IOC; in case a matching behaviour is found, merging the new event with the first suspicious event and/or related events related to the generated IOC; and generating a security related decision on the basis of the IOC.