Process Constraint System for Idle and Repeating Process Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise systems face challenges in securing complex environments due to the difficulty in identifying and removing security holes, with existing approaches either being overly restrictive or prone to false alarms.
Innovation Solution
A method and system that collect system call information to detect idle or repeating processes, using autocorrelation to determine periodic behavior, and constrain such processes to limit the attack surface, thereby reducing monitoring overhead and false alarms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If strict security rules are applied to eliminate attack surfaces, then security is improved, but system usability deteriorates due to excessive restrictions
Solution Approach 1:
The system dynamically adjusts security constraints based on process behavior analysis. Instead of applying static strict rules to all processes, the system continuously monitors system calls and adapts constraints in real-time, allowing legitimate processes to operate normally while restricting malicious ones.
Solution Approach 2:
The system changes security parameters dynamically based on detected process patterns. By analyzing system call sequences and identifying deviations from normal behavior, the system adjusts security constraints selectively, maintaining usability for normal operations while enhancing security against anomalies.
2Reliability
If machine learning is applied to detect deviations from baseline behavior, then general security protection is improved, but false alarm rate increases making the system unusable
Solution Approach 1:
The system segments the monitoring approach by categorizing processes into distinct groups (e.g., browser processes, system processes, user applications) and establishing separate baseline behaviors for each category. This segmentation reduces false alarms by applying context-specific detection rules rather than generic machine learning to all processes uniformly.
Solution Approach 2:
The system implements feedback mechanisms where detected anomalies are analyzed and used to refine detection thresholds and baseline behaviors. By continuously learning from actual system operation and adjusting detection parameters based on feedback, the system reduces false alarms while maintaining security protection.
3Measurement precision
If comprehensive monitoring is applied to detect all process behaviors, then detection accuracy is improved, but monitoring overhead increases
Solution Approach 1:
The system extracts and monitors only the most critical system calls that are indicative of malicious behavior or security-relevant operations. By selecting a focused subset of system calls rather than monitoring all process activities comprehensively, the system maintains detection accuracy for security threats while significantly reducing monitoring overhead.
Solution Approach 2:
The system applies partial monitoring strategically - monitoring in detail only when anomalies are detected or for high-risk processes, while using lighter monitoring for normal processes. This approach achieves sufficient detection accuracy for security purposes without the excessive overhead of continuous comprehensive monitoring of all processes.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
Methods and systems for process constraint include collecting system call information for a process. It is detected whether the process is idle based on the system call information and then whether the process is repeating using autocorrelation to determine whether the process issues system calls in a periodic fashion. The process is constrained if it is idle or repeating the limit an attack surface presented by the process.