Threshold-Based Process Call Detection for Hidden Threats
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large organizations face challenges in detecting malicious activities that mimic authorized user actions, as malicious actors exploit existing systems to gain unauthorized access, making it difficult to identify security threats effectively.
Innovation Solution
A threat detection system is implemented across networked computing devices to monitor process calls and identify patterns of seemingly benign activities that exceed expected thresholds, using machine learning to generate threat scores and trigger mitigation actions such as quarantine and reporting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional security monitoring methods are used to detect malicious activities, then the system can identify obvious threats, but it fails to detect malicious activities that mimic authorized user actions
Solution Approach 1:
The system changes the parameters of detection by monitoring multiple process call attributes simultaneously (call frequency, duration, target objects, system resources) rather than relying on single-signature matching. This enables detection of malicious activities that mimic normal user behavior by identifying abnormal patterns across multiple parameters.
Solution Approach 2:
The patent replaces traditional mechanical signature-based detection with a machine learning-based analytical system. The ML model analyzes patterns in process call data to detect threats, substituting rule-based mechanical detection with intelligent pattern recognition that can identify sophisticated malicious activities.
2Reliability
If comprehensive monitoring of all process calls is implemented to detect sophisticated threats, then detection capability improves, but system performance and resource consumption increase
Solution Approach 1:
The system implements partial monitoring by focusing on specific process calls and attributes that are most indicative of malicious activity. Rather than analyzing every single process call in detail, the system selectively monitors calls that match certain criteria or show abnormal patterns, reducing overhead while maintaining detection effectiveness.
Solution Approach 2:
The system performs preliminary analysis by establishing baseline behavior patterns for authorized users before actual threat detection begins. This preliminary action enables the ML model to quickly identify deviations from normal behavior without requiring extensive real-time analysis, improving both reliability and processing efficiency.
3Measurement precision
If threshold-based detection is used to identify abnormal activities, then false positives are reduced, but subtle threats may be missed
Solution Approach 1:
The system implements dynamic thresholds that adapt based on learned normal behavior patterns rather than using fixed static thresholds. The ML model continuously updates its understanding of authorized user behavior and adjusts detection thresholds accordingly, enabling the system to maintain high precision while remaining adaptable to new threat patterns and user behaviors.
Data Source
AI summary
Various aspects of the disclosure relate to automated monitoring and detection of computing threats. A threat detection computing system is configured to monitor for security threats on a networked system. The threat detection system monitors process calls to detect otherwise benign activity that exceeds an expected threshold and identifies threat actor actions that would otherwise go un-noticed and be associated with normal computer activity.