Behavioral Model Using Segmented N-gram Databases for Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection methods in computer systems are limited in accurately identifying anomalies that do not involve unknown sequences and fail to capture the complexity of system behavior, particularly in scenarios where security mechanisms are executed, due to their reliance on single action attributes and coarse-grained models, making them susceptible to mimicry attacks and inefficient in memory usage.
Innovation Solution
A behavioral model is generated by partitioning system logs into strands, selecting attributes, and creating distinct n-grams and n-gram groups that coexist within strands, allowing for the detection of anomalies through long-range correlations and reducing memory usage by representing n-grams and groups efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a single database of n-grams is used to model system behavior, then the model covers the entire computer system, but the accuracy of determining anomalies is reduced because any input sequence is matched to all known sub-sequences regardless of whether they ever appear in this arrangement
Solution Approach 1:
The patent segments the system behavior model into multiple process-specific n-gram databases instead of using a single amalgamated database. Each process has its own n-gram model that captures the specific sequences of system calls characteristic of that process. This segmentation allows for more accurate anomaly detection by matching input sequences against the appropriate process-specific model rather than a generic system-wide model.
2Adaptability or versatility
If a large selection of n-grams is used to model a large system, then the model can capture more system behavior patterns, but it simplifies the task for attackers to craft mimicry attacks
Solution Approach 1:
By dividing the n-gram database into process-specific segments, the patent reduces the attack surface for mimicry attacks. An attacker would need to understand and replicate the specific n-gram patterns of individual processes rather than exploiting a large amalgamated database. This segmentation makes it more difficult to craft successful mimicry attacks while still maintaining comprehensive behavior pattern coverage across the entire system.
Solution Approach 2:
The patent applies local quality by creating specialized n-gram models tailored to each specific process's behavior characteristics. Each process-specific database contains n-grams that are locally optimized for that process's typical operation patterns, rather than using a generic system-wide model. This localized approach improves detection accuracy for each process while reducing the vulnerability to generalized mimicry attacks.
3Device complexity
If coarse-grained n-gram models are used, then the model is simpler to implement, but it reduces the accuracy of determining anomalies
Solution Approach 1:
The patent implements a segmented n-gram modeling approach that balances complexity and accuracy. Instead of using overly fine-grained models that would be computationally expensive, it divides the system into process-specific segments with moderate-grained n-gram models. This segmentation allows for improved accuracy compared to coarse-grained system-wide models while maintaining implementation feasibility through the modular structure of process-specific databases.
Data Source
AI summary
A method of generating a behavioral model of a computer system. A processor partitions a system log of process events into a plurality of strands sharing common characteristics. The processor selects attributes from the strands and generates first distinct n-grams that include attributes from successive events within a strand. The processor generates a first plurality of n-gram groups, each including a plurality of the first distinct n-grams in which a first one of the plurality of first distinct n-grams coexists in a strand also containing a second one of the plurality of first distinct n-grams. The processor generates a first plurality of n-gram group arrangements, each containing a plurality of n-gram groups, and each of the n-gram groups included, in combination, in at least one strand, and the behavioral model containing the first distinct n-grams, the first plurality of n-gram groups, and the first plurality of n-gram group arrangements.