Global Program Lineage Graph for Suspicious Software Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprises face challenges in identifying malicious software, particularly when it is incorporated into legitimate commercial software, making it difficult to detect and consume significant IT resources.
Innovation Solution
A computer-implemented method constructs a global program lineage graph with nodes representing each version of a program and directional edges indicating progression over time, along with prevalence numbers, to identify anomalous behavior indicative of suspicious software, triggering alarms on a graphical user interface.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional software identification methods are used, then existing software can be recognized, but malicious software incorporated into legitimate software cannot be detected
Solution Approach 1:
The system performs preliminary actions by establishing a global program lineage graph that documents the expected version progression paths of legitimate software before malware infection occurs. This baseline allows subsequent detection of deviations caused by hijacked or malicious software, enabling identification of suspicious behavior through comparison against established norms.
Solution Approach 2:
The program lineage graph serves as an intermediary structure that mediates between raw software version data and security detection decisions. By representing the expected evolutionary path of software versions, it provides a reference framework that enables indirect detection of malicious modifications without requiring direct analysis of malware signatures.
2Loss of information
If comprehensive software monitoring is implemented, then all software versions can be tracked, but IT resources are consumed significantly
Solution Approach 1:
The system segments software monitoring by organizing tracked information into discrete program lineage graphs, where each graph represents a specific software application's version history. This segmentation allows the system to track comprehensive version information only for relevant software components rather than monitoring everything uniformly, reducing overall resource consumption while maintaining complete tracking where needed.
Solution Approach 2:
The system applies local quality by differentiating the monitoring depth based on software risk and importance. Critical software components receive comprehensive lineage tracking with detailed version history, while less critical software receives simplified tracking. This selective approach maintains information completeness for high-value targets while reducing IT resource consumption for lower-priority software.
3Measurement precision
If detailed program lineage tracking is performed, then software progression can be monitored, but system complexity increases
Solution Approach 1:
The system merges multiple individual software version tracking mechanisms into a unified global program lineage graph structure. By consolidating version history, progression paths, and relationship data into a single integrated graph model, the system achieves precise version progression detection while reducing the operational complexity of managing multiple separate tracking systems.
Data Source
AI summary
Systems and methods are disclosed for securing an enterprise environment by detecting suspicious software. A global program lineage graph is constructed. Construction of the global program lineage graph includes creating a node for each version of a program having been installed on a set of user machines. Additionally, at least two nodes are linked with a directional edge. For each version of the program, a prevalence number of the set of user machines on which each version of the program had been installed is determined; and the prevalence number is recorded to the metadata associated with the respective node. Anomalous behavior is identified based on structures formed by the at least two nodes and associated directional edge in the global program lineage graph. An alarm is displayed on a graphical user interface for each suspicious software based on the identified anomalous behavior.