Process Monitoring for Security in Computing Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computing environments, including machine learning environments, face vulnerabilities due to whitelisted processes that are not monitored, allowing nefarious entities to exploit them through attacks like code injection or process hollowing, leading to unintended malicious activities.
Innovation Solution
Implementing a method that operates in two modes: learning mode to establish baseline operating parameters and protection mode to monitor and enforce expected behavior of processes, generating alerts for deviations, thereby ensuring continuous security even for whitelisted processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If whitelisted processes are allowed to run without monitoring, then process operation efficiency is improved, but security vulnerability increases
Solution Approach 1:
The system performs preliminary actions by establishing baseline operating parameters for whitelisted processes during a learning phase before actual security monitoring begins. This baseline is built by observing and recording normal process behavior, which then enables the system to detect deviations and potential security threats without interfering with normal process operation.
Solution Approach 2:
The system implements continuous feedback by monitoring actual process behavior against established baselines and triggering alerts when deviations are detected. This feedback mechanism allows the security system to maintain awareness of process behavior changes while allowing whitelisted processes to operate normally, resolving the contradiction between efficiency and security.
2Reliability
If manual monitoring of whitelisted processes is implemented, then security detection capability is improved, but administrator workload increases
Solution Approach 1:
The security system performs self-service by automatically establishing baselines, monitoring process behavior, and generating alerts without requiring continuous manual intervention from administrators. The system autonomously learns normal process patterns and detects anomalies, freeing administrators from routine monitoring tasks while maintaining high security detection capability.
Solution Approach 2:
The patent replaces manual mechanical monitoring with automated electronic monitoring systems that continuously track process behavior parameters. This substitution eliminates the need for human administrators to manually review process activity, significantly reducing workload while improving detection consistency and coverage.
3Device complexity
If whitelisted processes are not monitored, then system simplicity is maintained, but susceptibility to code injection and process hollowing increases
Solution Approach 1:
The system applies partial monitoring by focusing surveillance on specific critical parameters and behaviors of whitelisted processes rather than implementing comprehensive monitoring of all process activities. This selective approach maintains relative system simplicity while providing sufficient detection capability to identify code injection and process hollowing attempts.
Solution Approach 2:
The system establishes baseline parameters in advance that define normal process behavior boundaries. These pre-established baselines enable the system to detect harmful factors like code injection and process hollowing by identifying deviations from expected behavior, providing protection without requiring complex real-time analysis of every process action.
Data Source
AI summary
A process monitoring methodology is disclosed. In a computer-implemented method, a selection of a process to be monitored is received. The process is to be at least partially performed using a component of a computing environment. An expected operating parameter of the process is determined. The process is also monitored to determine an actual operating parameter of the process. The actual operating parameter of the process is compared with the expected operating parameter of the process to generate a comparison result. An operation is then automatically performed based upon the comparison result.