Program Flow Classification for Hacking Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Hacking attempts in computing systems are challenging to detect, as they may not initially manifest noticeable differences, and new security flaws can be difficult to identify due to unknown impact and signatures.
Innovation Solution
The techniques involve classifying program execution flows using machine learning models, such as neural networks, to detect deviations from normal behavior by characterizing execution events like branch instructions, processor instructions, and interrupt events, generating alerts for abnormal activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security monitoring approaches are used, then system security is maintained, but hacking attempts remain undetected
Solution Approach 1:
The patent replaces traditional mechanical security monitoring with machine learning-based automated detection. The system uses neural networks to analyze program execution flows and automatically identify hacking attempts, eliminating the need for manual security analysis and enabling real-time detection of previously undetectable attacks.
Solution Approach 2:
The system performs self-monitoring and self-diagnosis by automatically analyzing its own execution flows. The machine learning model continuously learns from program execution patterns and detects anomalies without external intervention, enabling the system to detect hacking attempts on its own.
2Difficulty of detecting and measuring
If machine learning models are used to detect program flow deviations, then hacking detection capability is improved, but system complexity increases
Solution Approach 1:
The patent segments the complex security monitoring task into distinct components: execution event collection, program flow classification, anomaly detection, and alert generation. Each component handles a specific aspect of security monitoring, making the overall system more manageable and easier to implement despite the advanced machine learning techniques used.
Data Source
AI summary
Execution flows of a program can be characterized by a series of execution events. The rates at which these execution events occur for a particular program can be collected periodically, and the execution events statistics can be utilized for both training a machine learning model, and later on for making classification inferences to determine whether a program run contains any abnormality. When an abnormality is encountered, an alert can be generated and provided to supervisory logic of a computing system to indicate that an abnormal program flow has been detected.