Partial Bayesian Network for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection solutions in computing systems face challenges in efficiently distinguishing between system malfunctions and malware infections, particularly in identifying infected software components, and often require excessive processing resources and retraining, leading to high false alarm rates and unrecoverable damage.
Innovation Solution
The solution involves a layered anomaly analysis approach that segments data into localized layers for efficient processing, using statistical correlations and machine learning to detect anomalies in sensor and actuator networks, allowing for timely and effective identification and containment of malware-infected components by evaluating input versus output operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If AI and machine learning techniques are used for big data analysis in anomaly detection, then detection capability is improved, but processing requirements grow exponentially
Solution Approach 1:
The patent segments the data processing task by dividing the network into multiple nodes, each responsible for collecting and processing local data independently. This segmentation reduces the overall computational burden by distributing processing across multiple simple nodes rather than requiring complex centralized AI processing of all data.
Solution Approach 2:
The patent extracts only the essential information from the network data by having each node process only its local data and communicate only necessary information to other nodes. This extraction approach eliminates the need to process and analyze the entire big data dataset, reducing processing requirements while maintaining detection effectiveness.
2Measurement precision
If the number of data values analyzed is increased to improve detection accuracy, then detection precision is improved, but computational load increases
Solution Approach 1:
The patent applies local quality by having each network node process only its own local data values and maintain local models of normal behavior. Each node analyzes only the data relevant to its specific function, rather than processing all data values across the entire network. This localized approach maintains detection accuracy for each node while significantly reducing overall computational load.
3Reliability
If network coverage is expanded to detect more malware infections, then detection capability is improved, but the surface of attacks increases
Solution Approach 1:
The patent implements self-service by enabling each network node to autonomously detect anomalies in its own data and automatically respond to detected infections. Each node maintains its own model of normal operation and can independently identify and contain malware infections without requiring centralized intervention. This distributed self-service approach expands detection capability across the entire network while minimizing the attack surface by eliminating centralized single points of failure.
4Measurement precision
If retraining is performed to improve detection algorithms, then detection accuracy is improved, but time consumption increases
Solution Approach 1:
The patent applies preliminary action by having each node pre-configured with its own model of normal behavior specific to its function. These local models are established beforehand and allow nodes to immediately begin detecting anomalies without requiring continuous retraining. The models are updated locally as needed, eliminating the need for time-consuming centralized retraining operations while maintaining high detection accuracy.
Data Source
AI summary
Typical implementations of anomaly detection algorithms as means to detect failure of elements of the network are based on excessive processing due to AI and machine learning techniques adopted for big data analysis. Contrary to such approach, careful study of a network, particularly sensor and actuator rich network, allow for an efficient implementation-lower processing requirements and achieving better ratio of Probability-of-Detection (PD) to False-Alarm-Rate (FAR)—by segmentation of the data layers (grouping) and implement processing on smaller groups of data, eliminating unnecessary data values that add to the “noise”. Two different anomaly detection algorithm are employed: one detects anomaly of system and the other identifies defected programs, particularly by malware.