Provenance Graph Anomaly Detection for Fileless Malware
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional threat detection tools are ineffective against fileless malware, which evades detection by using legitimate system tools and memory, making it difficult to identify and prevent stealthy attacks that can compromise computer systems.
Innovation Solution
A provenance-based threat detection method that builds a graph of system activities, samples paths, calculates regularity scores, and embeds them into numerical vectors to detect anomalies and terminate malicious processes, independent of malware signatures and file-based analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional threat detection tools use file signatures and antivirus scanning, then they can detect known malware, but they fail to detect fileless malware that operates in memory without writing to disk
Solution Approach 1:
The patent segments the detection approach into multiple independent components: system call interception, provenance data collection, graph construction, path sampling, and anomaly detection. This segmentation allows each component to specialize in handling specific aspects of malware detection, enabling effective detection of fileless malware while maintaining robustness against known threats.
Solution Approach 2:
The patent transitions from traditional file-based detection (2D: file name, hash) to a multi-dimensional provenance graph approach that captures system calls, parent-child process relationships, timestamps, and execution contexts. This dimensional expansion enables detection of fileless malware by analyzing behavioral patterns across multiple dimensions rather than relying on static file attributes.
2Measurement precision
If threat detection tools analyze all system activities in detail, then they can identify stealthy malware, but the computational complexity and processing time increase significantly
Solution Approach 1:
The patent extracts only the most relevant and informative paths from the provenance graph using path sampling techniques. Instead of analyzing all possible system activity paths, it selectively extracts paths that exhibit anomalous patterns or deviate from normal behavior, significantly reducing computational complexity while maintaining high detection precision.
Solution Approach 2:
The patent applies partial analysis by focusing computational resources on sampling and analyzing a representative subset of provenance paths rather than exhaustively analyzing all paths. This partial action approach achieves effective anomaly detection with reduced processing complexity by concentrating analysis on the most suspicious or informative paths.
3Reliability
If security tools block access to system tools to prevent attacks, then they can stop malware execution, but they also block legitimate administrative tools that administrators need
Solution Approach 1:
The patent implements feedback-based detection by continuously monitoring system call patterns and provenance data to distinguish between legitimate administrative usage and malicious exploitation of system tools. This feedback mechanism allows the system to adaptively respond to threats while maintaining normal administrative operations, avoiding the need to block access to legitimate tools.
Solution Approach 2:
The patent changes the detection paradigm from blocking-based (black/white listing) to anomaly-based detection, where system tools are not inherently blocked but are monitored for suspicious behavior patterns. This approach allows legitimate administrative tools to operate normally while detecting and preventing malicious usage through behavioral analysis rather than access restriction.
4Reliability
If threat detection relies on known malware signatures and past malware patterns, then it can identify known threats, but it cannot detect zero-day malware or new attack variants
Solution Approach 1:
The patent performs preliminary action by establishing a baseline of normal system behavior through provenance graph construction and path sampling before malware execution. This preliminary understanding of legitimate system operations enables the detection of zero-day malware and new attack variants by identifying deviations from the established baseline, rather than relying on pre-existing malware signatures.
Solution Approach 2:
The patent changes the detection parameters from static malware attributes (file hashes, signatures) to dynamic behavioral parameters (system call sequences, process execution patterns, timing information). This parameter transformation enables detection of both known and unknown malware by focusing on behavioral characteristics that remain consistent across different malware variants and evolution stages.
Data Source
AI summary
Systems and methods for a provenance based threat detection tool that builds a provenance graph including a plurality of paths using a processor device from provenance data obtained from one or more computer systems and/or networks; samples the provenance graph to form a plurality of linear sample paths, and calculates a regularity score for each of the plurality of linear sample paths using a processor device; selects a subset of linear sample paths from the plurality of linear sample paths based on the regularity score, and embeds each of the subset of linear sample paths by converting each of the subset of linear sample paths into a numerical vector using a processor device; detects anomalies in the embedded paths to identify malicious process activities, and terminates a process related to the embedded path having the identified malicious process activities.