Script Exploitation Detection via BLEU Clustering and Autoencoder Perplexity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional script and command line review systems rely heavily on human intuition to detect malicious or abnormal scripts and command lines, leading to errors and inefficiencies in identifying potential exploitation of computing resources.
Innovation Solution
An exploitation detection system that collects and clusters script and command line data using a weighted variant of the Bilingual Evaluation Understudy (BLEU) score, generates encodings for input to a machine learning model, and ranks scripts and command lines based on unlikeliness measures, such as perplexity, to highlight potentially malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional review systems rely on human intuition to detect malicious scripts and command lines, then security experts can identify potential exploitation, but human error increases and detection efficiency decreases
Solution Approach 1:
The patent replaces the mechanical system of human intuition-based review with an automated machine learning system. The system uses trained models to analyze script and command line data, automatically identifying malicious patterns without human intervention in the detection process, thereby eliminating human error while maintaining high detection accuracy
Solution Approach 2:
The system enables self-service detection by using machine learning models that automatically analyze and flag suspicious scripts and command lines. The models continuously learn from data and perform autonomous detection, freeing security experts from manual review tasks while improving both reliability and productivity
2Reliability
If security experts manually review all launched scripts and command lines, then comprehensive detection is possible, but time consumption increases significantly
Solution Approach 1:
The system extracts and prioritizes only the most suspicious scripts and command lines using machine learning analysis. Instead of requiring review of all launched scripts, the system identifies and presents a focused subset of high-risk items, maintaining detection completeness while dramatically reducing the time required for security review
Solution Approach 2:
The system performs partial action by focusing computational and human review resources on the most critical cases. The machine learning model processes all data to identify anomalies, then presents only those requiring human attention, achieving comprehensive detection coverage with minimal time investment
3Reliability
If automated machine learning models are used to detect malicious scripts, then human error is reduced, but system complexity increases
Solution Approach 1:
The patent uses automated machine learning models as intermediaries between raw script data and security expert review. These models serve as mediators that translate complex data analysis into simplified risk assessments, reducing human error while managing system complexity through layered automation architecture
Data Source
AI summary
Script and command line exploitation detection is described. Initially, an exploitation detection system collects data describing scripts and command lines launched by various computing devices. The exploitation detection system clusters the scripts and command lines based on a measure of similarity, namely, Bilingual Evaluation Understudy (BLEU) score. Given the clusters and the data describing the scripts and command lines, the exploitation detection system generates encodings of the scripts and command lines for input to a machine learning model, e.g., an autoencoder. From this model, the exploitation detection system receives a measure of unlikeliness that a process corresponding to a given script or command line launches it. The exploitation detection system ranks the scripts and command lines according to the measure of unlikeliness. In this way, the exploitation detection system can display indications of the scripts and command lines that are most unlikely to be launched by their respective process.