Process Risk Scoring for Computer Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security systems are inadequate in efficiently identifying and managing malicious processes that consume resources, leading to resource unavailability for non-malicious processes and impacting their execution.
Innovation Solution
A system that collects and analyzes data from multiple client devices to calculate a risk score for each process, prioritizes resource allocation based on these scores, and maintains a whitelist and blacklist to manage process execution and resource distribution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If resource allocation is given to processes without security assessment, then system productivity is maintained, but system security deteriorates due to malicious processes consuming resources
Solution Approach 1:
The system performs preliminary security assessment by calculating risk scores for processes before allocating resources. The risk score calculation occurs during process execution or installation phase, allowing the system to identify and restrict malicious processes before they can consume significant resources, thus maintaining both security and productivity
Solution Approach 2:
The patent introduces an intermediary security assessment mechanism that acts as a mediator between process requests and resource allocation. The risk score serves as an intermediary metric that determines resource distribution, allowing legitimate processes to access resources while blocking malicious ones, thereby resolving the contradiction between security and productivity
2Measurement precision
If comprehensive data collection from multiple client devices is performed, then measurement precision of process risk is improved, but device complexity increases
Solution Approach 1:
The patent creates a universal risk score calculation system that operates across multiple client devices with diverse configurations. The centralized server performs multi-functional analysis by collecting data from various sources (resource allocation, user selections, device configurations) and processing them through a unified risk assessment algorithm, achieving high measurement precision without increasing individual device complexity
Solution Approach 2:
The centralized server acts as an intermediary that handles the complexity of data collection and analysis. Client devices simply collect and transmit raw data, while the server performs the complex risk score calculation by integrating multiple data sources, thus improving measurement precision while keeping client device complexity low
3Reliability
If additional processing is performed on high-risk processes, then reliability of malicious process identification is improved, but loss of time increases
Solution Approach 1:
The system applies local quality by performing additional processing only on specific processes that exceed the risk threshold, rather than uniformly processing all processes. This selective approach focuses computational resources on high-risk candidates, improving identification reliability for suspicious processes while minimizing time loss for the overall system
Solution Approach 2:
The risk threshold parameter dynamically determines which processes require additional processing. By adjusting this parameter, the system can balance between reliability and time loss - higher thresholds reduce time loss by processing fewer processes, while lower thresholds increase reliability by capturing more potential threats, allowing flexible optimization based on system conditions
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for categorizing a process using crowdsourcing are described. The methods include the action of receiving data indicating resources allocated upon execution of each of one or more processes. The methods further include the action of receiving data indicating a configuration of the client device. The methods further include receiving data indicating a user selection whether to execute each of the one or more processes. The methods further include the action of determining a risk score that reflects a likelihood that the process is a malicious process. The methods further include the action of identifying a particular process. The methods further include the action of performing additional processing on the particular process. The methods further include the action of determining an updated risk score for the particular process.