Real-time Software Attack Detection via Behavior Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current approaches to intrusion detection systems, particularly those using machine learning, fail to provide real-time protection against attacks on software programs, including zero-day attacks and misuse of software applications running on operating systems, secure boot, and other applications.
Innovation Solution
A method and apparatus for real-time detection of attacks on software programs using a trained detection model that predicts segments of behavior based on previous segments, compares predicted and measured behavior, and reports security events when discrepancies are found, incorporating features like execution time, power consumption, and cache misses, with the option to identify attack types using trained classifiers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anomaly detection based on machine learning is used to build a model of normal behavior, then detection capability is improved, but false positives increase and real-time protection against zero-day attacks is not provided
Solution Approach 1:
The behavior of the software program is divided into multiple segments, and predictions are made for each segment individually. This segmentation allows for more granular detection and reduces false positives by comparing predicted segments with actual measured segments at multiple points throughout program execution rather than treating the entire program as a single unit.
Solution Approach 2:
The system continuously compares predicted behavior segments with actually measured behavior segments and uses this feedback to detect deviations. When a deviation is detected, the system can trigger actions to prevent exploitation. This closed-loop feedback mechanism improves reliability by validating predictions against actual behavior in real-time.
2Measurement precision
If static checks with detection sensors are used to detect intrusions, then detection of known threats is improved, but protection against zero-day attacks and software misuse is not provided
Solution Approach 1:
The system performs preliminary action by training a detection model on behavior data collected during normal program execution before deployment. This pre-trained model establishes a baseline of expected behavior segments, enabling the system to detect both known threats through pattern matching and zero-day attacks through anomaly detection in previously unseen attack scenarios.
Solution Approach 2:
The system changes parameters by using multiple different behavior parameters (execution time, power consumption, cache misses, instruction counts) to characterize program behavior. This multi-parameter approach allows the detection model to identify attacks through changes in any of these parameters, providing versatility against both known and unknown threats while maintaining precision through multi-dimensional analysis.
3Measurement precision
If multiple behavior parameters are monitored for real-time detection, then detection accuracy is improved, but computational complexity and processing time increase
Solution Approach 1:
By segmenting the program execution into multiple smaller behavior segments, the system reduces the computational complexity of analyzing each segment individually. Each segment requires less processing power than analyzing the entire program at once, while the cumulative effect of analyzing multiple segments maintains high detection accuracy through comprehensive coverage of program behavior.
Solution Approach 2:
The system applies partial action by selecting and monitoring a specific set of key behavior parameters (execution time, power consumption, cache misses, instruction counts) rather than attempting to measure all possible program attributes. This selective monitoring approach achieves high detection accuracy with manageable computational complexity by focusing on the most informative parameters.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
The present invention is related to a method, a computer program code, and an apparatus for real-time detection of an attack on a software program running on a platform. The invention is further directed towards a method, a computer program code, and an apparatus for providing a detection model for use in such a method, computer program code, or apparatus. The invention is also directed towards a corresponding detection model. In a first step, a segment of a behavior of the software program is predicted (S1) based on one or more previous segments of its behavior using a trained detection model. Furthermore, a segment of the behavior of the software program is measured (S2). The predicted segment is then compared (S3) with the measured segment. In case the measured segment does not fit to the predicted segment, the occurrence of an attack is determined (S4), and a security event is reported (S6). Optionally, a type of attack may be identified S5 and included in the reported security event.