Runtime Verification Anomaly Detection Using Behavioral Model Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anomaly detection systems in computer system security are limited by simple and coarse-grained models that are prone to mimicry attacks, fail to detect anomalies without unknown sequences, and require large databases, leading to reduced accuracy and increased resource usage.
Innovation Solution
A method that verifies software execution events against a behavioral model using short and long-range correlations of n-grams, tri-grams, and bi-grams, allowing for efficient detection of anomalous behavior by checking against a shrinking set of acceptable arrangements, and halting execution when anomalies are identified.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single database of n-grams is used to model system behavior, then the model size is reduced, but the anomaly detection accuracy deteriorates due to coarse-grained matching that cannot distinguish between different process contexts
Solution Approach 1:
The patent segments the system behavior model into multiple n-gram databases, each corresponding to a specific process or transaction type. This segmentation allows the system to maintain smaller, more focused n-gram databases for each process while improving detection accuracy by matching events against the appropriate process-specific database rather than a single large amalgamated database.
2Measurement precision
If a large database of n-grams is used to capture complex system behavior, then the anomaly detection accuracy improves, but the resource usage and processing time increase significantly
Solution Approach 1:
By segmenting the n-gram database into process-specific subsets, the patent reduces the size of each individual database that needs to be searched during runtime verification. This segmentation maintains detection accuracy for each process type while reducing overall processing time and resource consumption compared to searching a single large database.
Solution Approach 2:
The patent performs preliminary analysis during the model building phase to identify and separate n-grams by process type and transaction strand. This preliminary organization into structured databases with defined schemas allows for faster runtime queries compared to searching an unstructured large database.
3Ease of manufacture
If traditional n-gram models are used for anomaly detection, then simple patterns can be detected, but the system fails to detect anomalies that involve missing sequences or contextual violations
Solution Approach 1:
The patent extends traditional n-gram modeling by adding dimensional context through process identifiers, transaction strands, and event attributes. This multi-dimensional approach allows the system to detect not only the presence of known n-gram patterns but also contextual violations and missing sequences by verifying that events occur in the expected process context and sequence.
Solution Approach 2:
The runtime verification system uses the behavioral model to provide feedback on whether observed event sequences conform to expected patterns. When deviations are detected, the system can identify specific anomalies such as missing security mechanisms or incorrect transaction sequences, enabling more comprehensive anomaly detection beyond simple pattern matching.
4Measurement precision
If operation sequence behavior models are used to detect unknown sequences, then foreign code execution can be detected, but the system cannot detect anomalies where known sequences are missing or improperly arranged
Solution Approach 1:
The patent adds contextual dimensions to sequence matching by incorporating process identifiers, transaction strands, and event attributes. This allows the system to verify not only that known sequences are present but also that they appear in the correct contextual framework, enabling detection of missing sequences and improper arrangements that traditional flat n-gram models cannot detect.
Data Source
AI summary
Runtime verification of software execution events against a behavioral model. For each event, it is verified whether there is a short range correlation of a sequence of the event and preceding event(s) with the behavioral model, and whether there is a long range correlation of a group of the sequences and of an arrangement of groups of the sequences with the behavioral model. After verifying each long range correlation, the arrangement of groups in the behavioral model event is substituted with an intersection of an arrangement of groups of the sequences with an arrangement of groups of the sequences in the behavioral model. If an event is not covered by a short range correlation or a long range correlation of a group or a long range correlation of an arrangement of groups, the event is indicated as anomalous.