Process Origin Inference for Security Analysis Efficiency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In modern computer systems, the high number of operating system processes makes it burdensome for security analyses to quickly locate and address high-risk, suspicious activities and attacks, as all processes need to be inspected, leading to inefficiencies in identifying potential security threats.
Innovation Solution
A method and system that categorize operating system processes based on their origin, using monitored behavior events to determine if a process has an internal or external origin, focusing security analysis and actions only on processes with an external origin, which are considered higher risk, by employing authentication events and input/output channel properties to infer origin.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all processes are inspected for security analysis, then security coverage is improved, but analysis time and complexity increase
Solution Approach 1:
The patent segments the set of all processes into two distinct groups: external-origin processes and internal-origin processes. This segmentation is achieved by monitoring behavior events and determining process origin. By dividing the analysis scope into these segments, the system applies security analysis only to the external-origin segment, thereby reducing analysis time while maintaining security coverage for high-risk processes.
Solution Approach 2:
The patent extracts the subset of processes with external origin from the complete set of processes. This extraction is performed by monitoring behavior events associated with each process and identifying those that originated from external sources. By taking out only the external-origin processes for security analysis, the system eliminates unnecessary analysis of internal processes, thus reducing time loss while preserving security coverage for the critical external processes.
2Reliability
If all processes are inspected for security analysis, then security coverage is improved, but computational complexity increases
Solution Approach 1:
The patent segments the analysis workload by categorizing processes into external-origin and internal-origin groups based on monitored behavior events. This segmentation reduces computational complexity by limiting detailed security analysis to only the external-origin segment, while internal-origin processes are identified and excluded from intensive analysis, thereby maintaining security coverage without overwhelming computational demands.
Solution Approach 2:
The patent extracts and isolates the subset of external-origin processes from the complete process set through behavior event monitoring. By taking out only these high-risk processes for detailed security analysis, the system reduces overall analysis complexity while maintaining comprehensive security coverage for the critical external processes that pose the greatest security risk.
3Productivity
If security analysis focuses only on external-origin processes, then analysis efficiency is improved, but risk of missing internal threats increases
Solution Approach 1:
The patent performs preliminary classification of all processes by monitoring their behavior events and determining their origin before applying detailed security analysis. This preliminary action identifies external-origin processes in advance, allowing the system to focus subsequent security analysis on these high-risk processes. The preliminary classification ensures that no external threats are missed while improving efficiency by avoiding detailed analysis of internal processes.
Solution Approach 2:
The patent implements a feedback mechanism where behavior events are continuously monitored to determine process origin, and this information feeds into the security analysis prioritization. The feedback loop ensures that external-origin processes are consistently identified and prioritized for security analysis, maintaining high threat detection accuracy for external threats while improving overall analysis efficiency through intelligent resource allocation.
Data Source
AI summary
Methods and systems for security analysis include determining whether a process has an origin internal to a system or external to the system using a processor based on monitored behavior events associated with the process. A security analysis is performed on only processes that have an external origin to determine if any of the processes having an external origin represent a security threat. A security action is performed if a process having an external origin is determined to represent a security threat.