Process Chain N-Gram Detection for Hidden Anomaly Events
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional anomaly detection techniques struggle to detect malicious software exploiting Arbitrary Code Execution (ACE) vulnerabilities due to their attempts to conceal activities and erase log information, leading to delayed alerts and inefficient real-time analysis of log files.
Innovation Solution
Anomaly detection is achieved by analyzing parent-child process relationships, creating process chains, and dividing them into N-gram subject tuples, using a prevalence model to determine anomaly events through examining the odds of these tuples.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anomaly detection techniques rely on log file analysis, then anomaly events can be detected after they affect system operations, but the detection is delayed and requires extensive time for expert analysis
Solution Approach 1:
The system performs preliminary actions by continuously monitoring and recording parent-child process relationships in real-time before anomaly events occur. This allows the system to have process chain data ready for immediate analysis when anomalies occur, eliminating the need for time-consuming retrospective log analysis and enabling instant detection of ACE vulnerabilities.
Solution Approach 2:
The invention extracts only the essential process relationship information (parent-child relationships) from the complex log data, separating this critical data from other unnecessary log information. This extraction creates a streamlined dataset that can be analyzed rapidly while still providing reliable anomaly detection, solving the contradiction between detection accuracy and time efficiency.
2Productivity
If log files are analyzed in real-time to effectively prevent damage, then anomaly detection speed improves, but the large amount of log file information and rule configuration makes detection difficult
Solution Approach 1:
The system extracts only the essential parent-child process relationship data from complex log files, separating this critical information from other unnecessary log entries. This extraction dramatically reduces the data volume requiring real-time analysis while maintaining detection effectiveness, thereby improving productivity without being overwhelmed by complexity.
Solution Approach 2:
The invention segments the complex log analysis task into a specific focus on parent-child process relationships only. By dividing the analysis scope into this manageable segment, the system can process data in real-time efficiently without being bogged down by the full complexity of general log file analysis.
3Measurement precision
If experts manually analyze log files to trace anomaly sources, then detection accuracy improves, but the complexity of detecting anomaly events increases
Solution Approach 1:
The system performs preliminary action by automatically building and storing process chain data structures in advance, organizing parent-child relationships into ready-to-analyze formats. This preliminary preparation eliminates the need for complex manual tracing operations while maintaining high precision in anomaly source identification, as the data is already structured for rapid querying.
Solution Approach 2:
The invention creates a simplified copy of the process execution structure in the form of process chains, which replicate the essential parent-child relationships without including all the complexity of actual log files. This copying allows for precise anomaly source identification through simple comparisons rather than complex manual analysis.
Data Source
AI summary
An anomaly detection method incorporated with an anomaly detection device running an operating system is disclosed and includes steps of: storing a parent-child relationship upon a process creation; retrieving every upper layer parent-child relationship relating to a parent process; creating a process chain according to the parent-child relationship and every upper layer parent-child relationship relating to the parent process; dividing the process chain into M N-gram subject tuples; and examining an odd of each of the N-gram subject tuples by inquiring a prevalence model and determining whether a creation of a process is an anomaly event according to the odd.