Malicious Behavior Detection in Process Chains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection and security software lack dynamic analysis to effectively detect malicious behavior across varying computer environments, relying on heuristic methods that are inefficient in different user environments.
Innovation Solution
A behavior analyzing module identifies chains of related processes, monitors events, stores data snapshots, and uses an AI model to determine the level of suspicion for each process, restoring affected objects if the chain is untrusted and isolating suspicious processes for further monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If heuristic methods are used to detect malicious programs, then detection can be performed with simple rules, but detection effectiveness degrades in varying user environments
Solution Approach 1:
The patent implements dynamic analysis by monitoring process chains in real-time and capturing snapshots of data modified by events. The system adapts to varying user environments by observing actual runtime behavior rather than relying on static heuristic rules, allowing the detection mechanism to dynamically adjust to different environments while maintaining effectiveness.
Solution Approach 2:
The patent replaces conventional heuristic methods (mechanical rule-based systems) with artificial intelligence models that perform behavioral analysis. The AI model analyzes captured events and modified data to detect malicious behavior, substituting the rigid mechanical heuristic approach with a more adaptive intelligent system that maintains effectiveness across diverse environments.
2Reliability
If conventional heuristic methods are used, then the system is easy to implement, but it lacks behavioral analysis capability
Solution Approach 1:
The patent performs preliminary actions by capturing snapshots of data before and during process execution. These snapshots are stored and later analyzed by the AI model to detect malicious behavior patterns, allowing the system to establish a baseline of normal behavior and compare it against actual runtime behavior for reliable detection.
Solution Approach 2:
The patent introduces an intermediary behavioral analysis layer between the process execution and detection decision. The behavior analyzing module captures events and modified data, processes them through an AI model, and then makes detection decisions. This intermediary layer adds behavioral analysis capability while managing complexity through modular architecture.
3Measurement precision
If AI models are used for behavioral analysis, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent segments the monitoring system into distinct functional modules: a behavior analyzing module that identifies process chains, an event monitoring component that captures events and modified data, a snapshot storage component, and an AI model for analysis. This segmentation allows the system to achieve high detection accuracy through comprehensive behavioral analysis while managing complexity through modular, organized architecture.
Data Source
AI summary
Disclosed herein are systems and method for malicious behavior detection in processing chains comprising identifying and monitoring events generated by a first process executing on a computing device; storing snapshots of data modified by any of the events; determining a level of suspicion for the first process, wherein the level of suspicion is a likelihood of the first process being attributed to malware based on the data modified by any of the events; in response to determining that the first process is not trusted based on the determined level of suspicion, identifying at least one sub-process of the first process; and restoring, from the snapshots, objects affected by the first process and the at least one sub-process.