Security Agent Probabilistic Analysis for Enumeration Attack Prediction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to effectively detect and protect against malicious enumeration-based attacks, which involve suspicious requests that can compromise data stored in computing environments, leading to potential damage from malware and other malicious activities.
Innovation Solution
A method and system utilizing a security sensor to track system events, determine sequences of operations, and analyze storage operations using a prediction unit with machine learning to identify probabilistic values indicating malicious activities, followed by advanced analysis and rectification measures such as deletion, quarantining, or terminating malicious processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security tools are used to detect malicious enumeration requests, then detection coverage is provided, but false positives increase and computational resources are consumed
Solution Approach 1:
The security system is divided into multiple specialized modules: enumeration request interceptor for capturing requests, analyzer for examining parameters, probabilistic value calculator for risk assessment, and verdict generator for decision-making. This segmentation allows each module to focus on specific tasks, improving detection accuracy while managing complexity through modular design.
Solution Approach 2:
A security agent acts as an intermediary between the enumeration request interceptor and the analysis module. The security agent receives intercepted requests, calculates probabilistic values based on multiple parameters, and generates verdicts. This intermediary layer processes requests efficiently before they reach the full analysis pipeline, reducing false positives and conserving computational resources.
2Measurement precision
If advanced analysis is conducted on all processes to detect malicious activities, then detection precision is improved, but computational resource consumption increases
Solution Approach 1:
The system performs partial analysis on all enumeration requests by calculating probabilistic values based on key parameters (file mask, request frequency, sequential enumeration patterns). Only requests exceeding a threshold probabilistic value undergo full advanced analysis. This partial action approach maintains detection precision for high-risk requests while conserving computational resources on low-risk requests.
Solution Approach 2:
The system changes the parameter of analysis depth based on the calculated probabilistic value. Requests with low probabilistic values undergo minimal parameter checking, while requests with high probabilistic values trigger comprehensive advanced analysis. This dynamic parameter adjustment optimizes the balance between detection precision and computational resource consumption.
3Reliability
If multiple verification stages are implemented to reduce false positives, then reliability is improved, but processing time increases
Solution Approach 1:
The system performs preliminary action by calculating probabilistic values and generating first verdicts before conducting full advanced analysis. This preliminary assessment filters out benign requests early in the process, reducing false positives that would otherwise require time-consuming comprehensive analysis. The preliminary probabilistic calculation uses readily available parameters from enumeration requests to make quick risk assessments.
Solution Approach 2:
The system dynamically adjusts the verification process based on the calculated probabilistic value. Requests with high probabilistic values automatically trigger multiple verification stages including advanced analysis and cross-process correlation, while requests with low probabilistic values undergo minimal verification. This dynamic approach maintains high reliability for suspicious requests while minimizing processing time for benign requests.
Data Source
AI summary
Systems and methods to predict an enumeration-based attack. A System includes a security sensor configured to track one or more system events and determine a sequence of operations of processes executed in response to the one or more system events. In addition, the system includes a security agent having a prediction unit configured to analyze the tracked storage operations of each process to generate a first security verdict and determine if a first probabilistic value identifying probability of finding the enumeration attack exceeds a first threshold value for a particular process. The security agent also includes an analysis module configured to obtain a full stack corresponding to the particular process from the security sensor, conduct the full stack analyses of the particular process, to generate a second verdict, and characterize the process as malicious, if the probabilistic value of the second verdict exceeds a second threshold value.