Parent-Child Process Chain N-Gram Detection for ACE Anomalies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional anomaly detection techniques struggle to efficiently detect malicious software exploiting Arbitrary Code Execution (ACE) vulnerabilities due to their reliance on log file analysis, which is complex and prone to delays, especially when malicious software conceals its activities and erases log information, requiring significant expertise and real-time analysis to prevent damage.
Innovation Solution
Anomaly detection is achieved by analyzing parent-child process relationships, creating N-gram subject tuples from process chains, and using a prevalence model to determine anomalies, reducing the need for log file parsing and improving efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anomaly detection techniques rely on log file analysis, then they can detect anomaly events, but the detection process becomes complex and time-consuming requiring significant expertise
Solution Approach 1:
The patent extracts only the essential parent-child process relationship information from the complex log file data, creating a simplified detection model that focuses on the creation hierarchy of processes rather than analyzing entire log files. This extraction approach maintains detection reliability while significantly reducing system complexity.
Solution Approach 2:
The patent segments the anomaly detection process into distinct components: collecting parent-child relationships, creating process chains, generating N-gram subject tuples, and comparing against prevalence models. This segmentation simplifies the overall detection system by breaking down the complex log analysis into manageable, independent modules.
2Loss of time
If log files are analyzed in real-time to prevent damage, then anomaly events can be detected early, but the large amount of log file information and rule configuration affects detection efficiency
Solution Approach 1:
The patent extracts only the critical parent-child process creation relationships from log files, ignoring other irrelevant log information. This selective extraction enables real-time processing by reducing the data volume that needs to be analyzed while maintaining the ability to detect anomalies efficiently.
Solution Approach 2:
The patent performs preliminary actions by pre-collecting and storing parent-child process relationships and pre-configuring prevalence models during normal system operation. When anomaly detection is needed, the system can quickly compare current process chains against these pre-prepared models, enabling fast real-time detection without the overhead of complex rule configuration during the detection phase.
3Loss of information
If malicious software erases log information to conceal activities, then detection becomes more difficult, but traditional log file analysis cannot detect anomalies until log information is generated
Solution Approach 1:
The patent performs preliminary collection and storage of parent-child process relationships during normal system operation, building a baseline of expected process creation hierarchies before malicious activity occurs. This preliminary action ensures that even if malicious software erases log information later, the system has already captured the essential process relationship data needed for detection.
Solution Approach 2:
The patent uses parent-child process relationships as an intermediary data structure that bridges the gap between system operations and anomaly detection. Instead of directly analyzing potentially erased log files, the system uses this intermediary representation of process hierarchies that is more resilient to log manipulation and can detect anomalies even when original log information is compromised.
4Measurement precision
If experts spend much time analyzing log files to trace anomaly sources, then accurate detection is achieved, but real-time prevention is compromised
Solution Approach 1:
The patent extracts and focuses exclusively on parent-child process relationship data, removing the need to analyze entire log files to trace anomaly sources. By concentrating on this specific, essential information, the system achieves accurate anomaly source identification much faster than traditional comprehensive log analysis.
Solution Approach 2:
The patent segments the anomaly detection task into collecting parent-child relationships, creating process chains, generating N-gram tuples, and comparing against prevalence models. This segmentation enables parallel processing and faster analysis of the anomaly source by breaking down the complex tracing task into simpler, faster operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An anomaly detection method incorporated with an anomaly detection device (100) running an operating system is disclosed and includes steps of storing a parent-child relationship upon a process creation; retrieving every upper layer parent-child relationship relating to a parent process; creating a process chain according to the parent-child relationship and every upper layer parent-child relationship relating to the parent process; dividing the process chain into M N-gram subject tuples; and examining an odd of each of the N-gram subject tuples by inquiring a prevalence model (126) and determining whether a creation of a process is an anomaly event according to the odd.