PowerShell Detection via Multi-Parameter Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing endpoint security systems face a high number of false positives when detecting malicious activity in fileless attacks, leading to potential disabling of detection mechanisms, which compromises the security of computing devices.
Innovation Solution
A system and method that integrates endpoint security agents with global or enterprise security features to correlate multiple behaviors of PowerShell processes, including command line arguments and execution behaviors, using custom API hooking and machine learning algorithms to assign scores and adjust thresholds dynamically, thereby reducing false positives and enhancing detection reliability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If existing endpoint security systems use single-check detection methods for PowerShell processes, then detection simplicity is maintained, but false positive rates increase significantly
Solution Approach 1:
The patent combines multiple detection parameters (command line arguments, runtime behaviors, API calls) into a unified multi-factor detection system. Instead of relying on single-check methods, the system integrates multiple security checks that work together to evaluate PowerShell processes, thereby reducing false positives while maintaining detection accuracy.
Solution Approach 2:
The system dynamically adjusts detection thresholds and parameters based on contextual analysis of multiple behaviors. By changing the parameters from fixed single-check criteria to flexible multi-parameter evaluation with adaptive thresholds, the system reduces false positives while maintaining reliability.
2Reliability
If endpoint security systems block PowerShell processes based on single flags, then security coverage is improved, but false alarms increase leading to mechanism disabling
Solution Approach 1:
The detection system transitions from static single-flag blocking to dynamic multi-parameter evaluation. The system adapts its detection behavior based on the combination of parameters observed, allowing legitimate processes to pass while blocking malicious ones, thereby maintaining security coverage without generating excessive false alarms that would lead to disabling.
Solution Approach 2:
The system incorporates feedback mechanisms where detection results from multiple parameters are combined and evaluated together. This feedback loop allows the system to learn from patterns and adjust its behavior, maintaining high security coverage while minimizing false alarms that would compromise system usability.
3Reliability
If multi-behavior correlation analysis is implemented, then false positives are reduced, but computational complexity increases
Solution Approach 1:
The complex multi-behavior analysis is segmented into distinct analysis phases (command line analysis, runtime behavior analysis, API call analysis). Each phase handles specific parameters independently, then results are combined. This segmentation reduces the apparent complexity by breaking down the overall complex task into manageable segments.
Solution Approach 2:
The system performs preliminary analysis of individual parameters before combining them into the final multi-behavior correlation. By pre-processing and pre-evaluating each parameter separately, the system simplifies the subsequent correlation step, reducing overall computational complexity while maintaining detection reliability.
Data Source
AI summary
There is disclosed in one example a computing apparatus, including: a processor and memory; and instructions encoded within the memory to instruct the processor to: identify a scripted process for security analysis; hook application programming interface (API) calls of the scripted process to determine a plurality of pre-execution parameters and runtime parameters; assign individual scores to the pre-execution parameters and runtime parameters; compute a sum of the individual scores; compare the sum to a threshold; and detect malicious or suspicious activity if the sum is above the threshold.