Streaming Threat Prediction Using Cross-Organization Detection Data

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Determining whether a program is malware or exhibiting malicious behavior is time-consuming and resource-intensive, and existing systems struggle to efficiently predict and mitigate future security threats in data streams.

Innovation Solution

A system that aggregates data from similar organizations to identify potential security threats, analyzes previous malicious events, and generates recommendation data to protect computing devices from future attacks by implementing a cloud-based service with components like a profile component, graph generator, and recommendation component to provide proactive defense strategies.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If security systems analyze complete program code to detect malware, then detection accuracy is improved, but analysis time and computational resources increase significantly

Engineering Contradiction:

Improvemalware detection accuracyVSAvoidanalysis time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent extracts and analyzes only specific code sections (suspect code sections) rather than complete programs. The system identifies and isolates potentially malicious code segments for focused analysis, reducing the overall analysis scope while maintaining detection effectiveness.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system performs partial analysis by focusing computational resources on suspect code sections rather than analyzing entire programs. This partial action approach analyzes only the portions of code that are most likely to contain malicious behavior, reducing time and resource consumption.

Inventive Principle:

Principle #16Partial or excessive action

2Measurement precision

If security systems analyze complete program code to detect malware, then detection accuracy is improved, but computational resources consumed increase significantly

Engineering Contradiction:

Improvemalware detection accuracyVSAvoidcomputational resources

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The system extracts and analyzes only specific code sections (suspect code sections) rather than complete programs. The system identifies and isolates potentially malicious code segments for focused analysis, reducing the overall analysis scope while maintaining detection effectiveness.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Inventive Principle:

Principle #16Partial or excessive action

3Measurement precision

If security systems use obfuscation detection techniques, then malware identification accuracy is improved, but system complexity increases

Engineering Contradiction:

Improvemalware identification accuracyVSAvoidsystem complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system performs preliminary analysis to identify suspect code sections before conducting detailed obfuscation detection. By pre-processing the code to locate potentially malicious segments, the system reduces the complexity of subsequent obfuscation analysis while maintaining high detection accuracy.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12634299B2Threat prediction in a streaming system

Publication Date: 2026.05.19 CROWDSTRIKE

AI summary

Techniques for aggregating data usable for generating security recommendations are discussed herein. A system can aggregate detection data from host devices associated with different organizations based on profile information describing each organization. The system can analyze the aggregated data to identify potential security threats in a data stream, and generate recommendation data usable for defending the data stream from future malicious events.