Remote Administration Detection via Event Dependency Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus programs fail to effectively detect and prevent unauthorized remote administration of computers, particularly due to the stealthy nature of malicious software that does not perform explicit malicious actions and can mimic legitimate administrator activities, leading to false alarms and undetected threats.
Innovation Solution
A system and method that intercepts events in a computer system, determines event parameters, identifies dependent events, and analyzes applications to detect remote administration by comparing event rules with pre-defined thresholds, blocking malicious activity and removing unauthorized applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional antivirus programs are used to detect malicious software, then they can identify known threats, but they fail to detect stealthy malicious programs that mimic legitimate administrator activities
Solution Approach 1:
The system dynamically monitors and analyzes sequences of system events rather than relying on static signatures. It adapts to new threats by learning from event patterns and updating its detection models in real-time, allowing it to identify both known and unknown malicious activities that mimic legitimate administrator behavior.
Solution Approach 2:
The system changes the detection parameters from simple signature matching to complex multi-parameter event sequence analysis. It examines timestamps, event types, source identifiers, and behavioral patterns simultaneously, transforming the detection approach to handle stealthy threats that traditional parameter-based methods miss.
2Object-affected harmful factors
If antivirus programs perform explicit malicious action detection, then they can identify obvious threats, but they produce false alarms when legitimate administrator activities are performed
Solution Approach 1:
The system performs preliminary analysis of event sequences and establishes baseline patterns of legitimate administrator behavior before making detection decisions. By pre-learning normal administrative workflows and their event patterns, it can distinguish between legitimate and malicious activities more reliably, reducing false alarms while maintaining detection effectiveness.
Solution Approach 2:
The system implements feedback mechanisms where detection results and analyst decisions are used to continuously refine the event pattern models. This feedback loop allows the system to learn from false alarms and improve its ability to distinguish legitimate administrator activities from malicious ones, progressively reducing false positive rates.
3Productivity
If comprehensive event monitoring is implemented to detect all malicious activities, then detection coverage improves, but system complexity and processing overhead increase
Solution Approach 1:
The system extracts and focuses on the most discriminative event parameters and sequences that are most indicative of malicious activity. Rather than analyzing all possible system events equally, it identifies and monitors only the critical event types and patterns that provide the highest detection value, reducing processing overhead while maintaining comprehensive coverage of relevant threats.
Solution Approach 2:
The monitoring system is segmented into modular components that handle different aspects of event analysis independently. Event interception, parameter extraction, sequence analysis, and detection decision-making are separated into distinct modules, making the system more manageable and efficient while maintaining comprehensive detection capabilities.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are system and method for protecting computers from unauthorized remote administration. One exemplary method comprises: intercepting events occurred in a computer system; determining parameters of each intercepted event for identifying each intercepted event as being relating to a first data transfer by an application in a computer network or a second data transfer to an application from a peripheral data input device of the computer system; determining two intercepted events as being dependent on each other; determining a rule defining a dependency of the parameters of the two intercepted events; determining a degree of similarity of the rule and a previously created rule; if the degree of similarity exceeding a selected threshold value, identifying at least one application based at least on the rule and the previously created rule; and analyzing the at least one application for detecting a remote administration application.