OS Intrusion Detection Using Privilege Change Thresholds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems face challenges in identifying potential security intrusions early and accurately due to limited data availability and the difficulty in modeling attack patterns, leading to false positives and delayed detection of anomalous behavior.
Innovation Solution
An intrusion detection system analyzes operating system data, such as system dumps, log records, and security calls, to set thresholds for user events and security checks, using machine learning to identify suspicious activity and take rapid action.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional intrusion detection methods are used, then detection capability is limited, but false positives increase and detection accuracy decreases
Solution Approach 1:
The patent segments intrusion detection into multiple independent analysis components: privilege change detection, event occurrence frequency analysis, and threshold-based anomaly detection. Each component processes specific aspects of system behavior separately, then combines results to improve overall detection accuracy while reducing false positives through multi-factor verification
Solution Approach 2:
The patent dynamically changes detection parameters by establishing threshold values for privilege changes and event frequencies. The system adjusts these parameters based on learned normal behavior patterns, enabling adaptive detection that maintains high accuracy while minimizing false alarms through parameter-based anomaly identification
2Measurement precision
If behavior analysis with machine learning is used, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The system implements self-service through automated threshold establishment and behavior pattern learning. The machine learning component automatically analyzes system behavior, establishes baseline thresholds for normal operations, and detects anomalies without requiring manual configuration or complex external systems, thereby improving accuracy while managing complexity through automation
Solution Approach 2:
The patent introduces an intermediary layer between raw system data and detection decisions. This intermediary component processes and normalizes diverse system events, applies learned behavior patterns, and translates complex data into standardized anomaly scores, simplifying the overall system architecture while maintaining high detection accuracy
3Reliability
If comprehensive data analysis is performed, then intrusion detection capability improves, but processing time increases
Solution Approach 1:
The patent applies preliminary action by pre-establishing threshold values for privilege changes and event frequencies based on normal system behavior. These thresholds are prepared in advance through behavior analysis, enabling the system to quickly compare real-time events against predetermined criteria and detect intrusions rapidly without performing complex analysis during the detection moment
Data Source
AI summary
Identifying an intrusion (e.g., a malicious intrusion) into a computing system is a challenging problem, because there is limited data available about what an intrusion would look like while it is progress. In one embodiment, input data reflecting operation of an operating system is received and a potential security intrusion for the operating system using the input data is identified by at least one of determining, based on the input data, that a first number of privilege changes exceeds a first threshold value or determining, based on the input data, that a second number of occurrences of an event, for a first user, exceeds a second threshold. An action can be taken to alleviate the potential security intrusion.