Runtime Intrusion Detection via Call Trace and Memory Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Big data platforms like Hadoop and Spark face challenges in detecting insider attacks and data theft due to their distributed nature and the limitations of traditional security measures, which struggle to identify anomalies in system and library calls, especially when insider threats masquerade as legitimate users or change datanode configurations.
Innovation Solution
A runtime intrusion detection technique that creates behavior profiles for each task by analyzing system and library calls, along with memory access patterns, and shares these profiles among replica datanodes for verification, using Principal Component Analysis (PCA) to identify discrepancies and detect intrusions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional security measures are used to monitor system calls, then detection capability is limited, but false positives increase and real threats are missed
Solution Approach 1:
The patent segments the security monitoring system into multiple specialized components: call trace analysis module, memory access pattern analysis module, behavior profile generation module, and anomaly detection module. Each component focuses on specific aspects of system behavior, improving detection precision while distributing complexity across modular units rather than a monolithic system.
Solution Approach 2:
The patent introduces behavior profiles as an intermediary representation that mediates between raw system calls and threat detection. These profiles capture normalized system and library call patterns, serving as a bridge that enables comparison against known attack patterns without requiring direct complex analysis of every raw system call.
2Reliability
If comprehensive monitoring of system calls is implemented, then detection capability improves, but processing overhead and time consumption increase
Solution Approach 1:
The patent performs preliminary actions by pre-generating behavior profiles that capture essential system and library call patterns before actual threat detection occurs. These profiles are created during normal operation and stored for rapid comparison during security events, enabling fast anomaly detection without real-time complex analysis.
Solution Approach 2:
The patent replaces mechanical systematic analysis of every system call with a more efficient information processing approach using behavior profiles and pattern matching. Instead of analyzing each raw system call in real-time, the system substitutes this with comparison against pre-computed behavioral signatures, significantly reducing processing time while maintaining detection reliability.
3Adaptability or versatility
If traditional intrusion detection methods are used, then implementation is simpler, but insider attacks and data theft cannot be detected
Solution Approach 1:
The patent creates a universal detection framework that handles multiple attack types through a single integrated system. The behavior profile approach is attack-agnostic, capable of detecting insider threats, data theft, control-flow attacks, and other anomalies using the same core mechanism of comparing system call patterns against established profiles, rather than requiring separate specialized detectors for each threat type.
Solution Approach 2:
The patent changes the detection parameters from traditional security metrics to behavioral parameters based on system and library call patterns. By monitoring changes in call frequency, sequence, and characteristics, the system can detect various attack types including insider threats that traditional methods miss, adapting to different attack scenarios through parameter-based analysis rather than signature-based detection.
Data Source
AI summary
A runtime attack can be detected on a big data system while processes are executed on various nodes. A behavior profile can be maintained for tasks or processes running on different nodes. The existence of a call variance in one of the traces for one of the behavior profiles can be determined. A memory variance can also be detected in one of the behavior profiles. A runtime attack has occurred when both the memory variance and the call variance are determined to exist.