Script Classification via ML Prediction on Computing Platform
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in effectively classifying software scripts as malicious or benign before they are executed on a computing platform, which can lead to platform downtime and data compromise.
Innovation Solution
A system that uses a classification machine learning model to predict the effect of software on a computing platform, operating in real-time to receive, isolate, and classify scripts as benign or malicious, without significantly impacting processing pipelines or user experience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a classification machine learning model is deployed to classify scripts in real-time, then platform security and malicious script detection are improved, but processing time and computational resources are consumed
Solution Approach 1:
The system performs preliminary classification of scripts using a machine learning model before they are executed on the platform. Node watchers continuously monitor incoming traffic and preemptively classify scripts, allowing the platform to block malicious scripts before they can cause harm, thus improving security without significantly impacting processing time for legitimate scripts
Solution Approach 2:
A dedicated classification service acts as an intermediary between script submission and script execution. This service receives scripts from node watchers, classifies them using the machine learning model, and returns classifications to the watchers. This intermediary architecture isolates the computational overhead of ML inference from the main processing pipeline, preventing bottlenecks in legitimate script processing
2Measurement precision
If comprehensive script classification is implemented across all computing nodes, then detection accuracy is improved, but system complexity and resource requirements increase
Solution Approach 1:
The system segments the script classification functionality into distributed node watchers deployed on individual computing nodes, each responsible for monitoring and classifying scripts on its local node. This segmentation allows comprehensive coverage across all nodes while keeping each individual component relatively simple and manageable
Solution Approach 2:
The node watchers are designed as universal components that can be deployed across all types of computing nodes in the platform. Each watcher performs multiple functions: monitoring incoming traffic, extracting scripts, communicating with the classification service, and implementing blocking decisions. This multi-functionality reduces overall system complexity by using a standardized approach across diverse nodes
3Productivity
If real-time script classification is performed, then malicious script blocking is improved, but computational resources and processing overhead increase
Solution Approach 1:
The system applies partial classification action by only classifying scripts that are actually submitted to the platform, rather than continuously analyzing all possible scripts. Node watchers monitor traffic and extract only the scripts that need to be classified, reducing unnecessary computational overhead while maintaining effective blocking of malicious scripts
Solution Approach 2:
The classification service provides feedback to node watchers about script classifications, enabling watchers to immediately block malicious scripts without re-analysis. This feedback mechanism improves blocking efficiency by allowing rapid response to threats while reducing redundant computational resources that would be spent on re-classifying the same scripts
Data Source
AI summary
Aspects of the disclosure are directed to a system for classifying software as malicious or benign based on predicting the effect the software has on the platform before the software is actually deployed. A system as described herein can operate in close to real-time to receive, isolate, and classify software as benign or malicious. Aspects of the disclosure provide for accurate classification of malicious programs or scripts even if ostensibly the program appears benign, and vice versa, based on the effect predicted by a machine learning model trained as described herein. The system can also be implemented to isolate and verify incoming scripts or software to the platform, to provide a predicted classification while not substantially impacting processing pipelines involving platform resources or the user experience with the platform in general.