Static Analysis Tool Reduces False Positives in APT Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Advanced Persistent Threat (APT) mitigation solutions often generate false positives when identifying data exfiltration, as they assume a direct relationship between reading sensitive information and sending data, which may not be the case, leading to unnecessary actions.
Innovation Solution
An APT mitigation solution interoperates with a static analysis tool, utilizing its taint analysis capabilities to validate potential data exfiltration attacks by decompiling the binary and analyzing data flows between sources and sinks, reducing false positives by confirming if the information sent is related to the read data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If APT mitigation solution uses simple monitoring of read and send operations, then detection speed is fast, but false positive rate increases
Solution Approach 1:
The patent introduces static analysis tool as an intermediary component between the APT mitigation solution and the application binary. This mediator performs comprehensive data flow analysis to validate potential exfiltration events, confirming whether sent data is actually related to read operations. The intermediary resolves the contradiction by adding analytical depth without significantly impacting detection speed.
Solution Approach 2:
The patent applies preliminary action by performing static analysis on application binaries in advance to build data flow models before runtime monitoring. This pre-computed information is then used to quickly validate potential exfiltration events during runtime, maintaining fast detection speed while reducing false positives through pre-established knowledge of legitimate data flows.
2Measurement precision
If APT mitigation solution integrates static analysis tool, then measurement precision improves, but device complexity increases
Solution Approach 1:
The patent makes the static analysis tool multi-functional by using it for both building data flow models during setup and for validating potential exfiltration events during runtime. This universal application reduces the need for separate specialized components, thereby limiting the increase in system complexity while maintaining improved measurement precision.
Solution Approach 2:
The system implements self-service by having the APT mitigation solution automatically invoke the static analysis tool and integrate its findings without requiring manual configuration or intervention. The solution autonomously manages the complexity of integrating multiple analysis components, reducing the operational burden and effective system complexity.
3Measurement precision
If APT mitigation solution performs comprehensive data flow analysis, then false positive rate decreases, but processing time increases
Solution Approach 1:
The patent performs comprehensive data flow analysis in advance to build lookup tables and models of legitimate data flows within the application. During runtime, when potential exfiltration is detected, the system quickly queries these pre-computed models rather than performing full analysis, thereby maintaining low false positive rates while minimizing processing time delays.
Solution Approach 2:
The patent segments the data flow analysis into distinct phases: offline model building phase and online validation phase. The computationally intensive comprehensive analysis is performed offline and segmented from the runtime operations. This segmentation allows thorough analysis without impacting real-time detection performance, reducing both false positives and processing time loss.
Data Source
AI summary
In response to a local Advanced Persistent Threat (APT) agent identifying a potential data exfiltration attack, the binary identified in the attack is sent to a static analysis tool for further analysis. The agent also identifies a source and a sink involved in the potential data exfiltration. The static analysis tool decompiles the binary, and then runs the de-compiled code through a static analysis to identify data flows between the source and the sink, e.g., a data flow from the source that is the method used to read sensitive information, and a data flow to the sink that is the method used to write to the remote system. If there are such data flows, the activity reported by the agent is likely a true exfiltration attack. Based on this flow determination, the static analysis tool returns a response to the agent validating that the activity is an attack.