Perturbed Graph Utility Detection for Malicious Application Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of perturbed graphs in network security applications for detecting malicious applications is problematic due to the unknown loss in utility compared to base graphs, making them unreliable for critical tasks like preventing malware execution.
Innovation Solution
The method employs an Edge Current-Flow Based Betweenness Centrality (ECFBBC) metric to determine the utility value of a perturbed graph by summing ECFBBC values of matching edges and penalizing spurious edges, ensuring the perturbed graph has a utility value above a threshold before using it for malicious application detection and prevention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a perturbed graph is used to reduce the size of the base graph and improve computational efficiency, then computational efficiency is improved, but the utility of the graph for detecting malicious applications is reduced
Solution Approach 1:
The patent applies preliminary action by calculating ECFBBC values for all edges in the base graph before creating the perturbed graph. This pre-computation of edge importance metrics allows the system to subsequently evaluate the utility of the perturbed graph against the original base graph, ensuring that the simplified graph retains sufficient utility for malicious application detection while achieving computational efficiency
Solution Approach 2:
The patent implements feedback by comparing the ECFBBC values of edges in the perturbed graph against the base graph. This feedback mechanism allows the system to quantify the loss in utility when using a perturbed graph, enabling informed decisions about whether the perturbed graph maintains sufficient reliability for security operations
2Quantity of substance
If the base graph is perturbed by adding or deleting edges or collapsing vertices, then the size of the graph is reduced, but the accuracy of malicious application detection is reduced
Solution Approach 1:
The patent applies parameter changes by transforming the base graph into a perturbed graph with modified structural parameters (fewer edges, collapsed vertices). The ECFBBC metric serves as a parameter to measure and control the quality of this transformation, ensuring that the reduced graph size does not compromise detection accuracy below acceptable thresholds
3Reliability
If the base graph is used for malicious application detection, then detection accuracy is maintained, but computational resources and time are consumed
Solution Approach 1:
The patent applies partial action by using a perturbed graph that contains only a subset of the edges and vertices from the base graph. This partial representation is sufficient for maintaining detection accuracy while significantly reducing computational time and resources required for analyzing malicious applications
Data Source
AI summary
Preventing a malicious computer application from executing in a computing environment. In one embodiment, a method may include identifying a base graph, identifying a perturbed graph, determining an importance of each of the edges in the base graph using an Edge Current-Flow Based Betweenness Centrality (ECFBBC) metric, identifying the edges in the base graph that match the edges in the perturbed graph, determining a utility value for the perturbed graph, determining whether the utility value is above a threshold utility value, in response to determining that the utility value is above the threshold utility value, employing the perturbed graph to analyze a computer application and determine that the computer application is malicious, and performing a security action on the malicious computer application to prevent the malicious computer application from executing in a computing environment.