OLE Automation Process Attribution via ActivityID Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security products struggle to detect the indirect creation of processes by malware, which masks the true actor behind malicious activities, leading to missed detection links between processes.
Innovation Solution
The system identifies created processes and analyzes event notifications to determine if a process was created via COM calls, using ActivityIDs and IDs to establish the indirect creation relationship between ancestor and created processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware uses OLE Automation to indirectly create processes, then the malware can mask its true identity and evade detection, but security products cannot establish the creation link between ancestor and created processes
Solution Approach 1:
The patent uses ActivityID as an intermediary identifier to bridge the gap between ancestor processes and created processes in OLE Automation scenarios. By capturing and correlating ActivityID across process creation events, the system reconstructs the indirect creation link that would otherwise be lost, enabling security products to trace malware actions back to their true source even when traditional parent-child process relationships are obscured.
2Reliability
If the system monitors all process creation events to detect malware, then detection coverage increases, but the complexity of analyzing and correlating event data increases
Solution Approach 1:
The patent extracts and focuses on specific critical fields (ActivityID, process identifiers, timestamps) from the overwhelming stream of process creation events. By filtering and extracting only the relevant correlation keys needed to establish creation links, the system reduces the complexity of event analysis while maintaining comprehensive malware detection coverage, avoiding the need to process and analyze every detail of each event.
3Productivity
If traditional process monitoring is used, then simple direct process creations are detected, but indirect process creations via COM calls are missed
Solution Approach 1:
The patent performs preliminary capture and storage of ActivityID information at the moment of process creation, before the indirect creation relationship becomes obscured. By pre-recording this correlation key in event buffers or temporary storage structures, the system enables rapid later retrieval and matching without requiring complex real-time analysis, thus maintaining both detection speed and attribution accuracy for indirect process creations.
Data Source
AI summary
At least one non-transitory machine-readable medium includes machine-readable instructions to cause at least one processor circuit to at least: receive a first event message from an event log, the first event message including (i) a first identifier of a first event for a first process and (ii) a first timestamp of the first event; determine, based on the first identifier, a type of the first event to be a client call finish; determine the first identifier is active; record the first identifier, the first timestamp, and the first event in a memory; determine that at least one of a client call interface registration event or a client call endpoint registration event that has the first identifier was received; reattribute the first process; and remove the first identifier, the first timestamp, and the first event from the memory.