Tag-Based Targeted Attack Detection System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies are inadequate in detecting and investigating targeted attacks, particularly those that do not use malicious software, as they fail to identify signs of attacks that occur through legitimate tools or dynamic creation of malicious code in computer memory, leading to delayed detection and ineffective defense mechanisms.
Innovation Solution
A method and system that involve adding tags to detect computer attacks by receiving security notifications, searching threat databases, identifying suspicious activity, and extracting tags to identify signatures of targeted attacks, which includes analyzing penetration tests and network protocols for privileged access, and gathering log records and memory dumps when necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature analysis and heuristic analysis are used to detect malicious software, then traditional viruses and worms can be detected, but targeted attacks and advanced persistent threats without malicious software cannot be detected
Solution Approach 1:
The patent segments the detection process into multiple independent modules: signature analysis module, heuristic analysis module, behavioral analysis module, and tag-based correlation module. Each module handles specific types of threats independently, allowing the system to detect both traditional malicious software and advanced targeted attacks without requiring a single monolithic detection mechanism.
Solution Approach 2:
The patent creates a universal detection framework that can handle multiple attack types through a single system. The behavioral analysis engine and tag correlation system serve multiple functions: detecting malicious software, identifying targeted attacks, analyzing attack patterns, and correlating events across different security modules, thereby providing broad coverage without requiring separate specialized systems.
2Measurement precision
If existing detection technologies are used, then traditional malicious software can be identified, but complex attacks and long-duration attacks remain undetected
Solution Approach 1:
The patent implements preliminary action by pre-defining tags for various suspicious activities and attack patterns, and by establishing correlation rules in advance. When security events occur, the system immediately matches them against pre-configured tags and rules, enabling rapid detection of complex and long-duration attacks without requiring time-consuming analysis of each individual event.
Solution Approach 2:
The patent incorporates feedback mechanisms where detection results and attack patterns are continuously analyzed to refine tag definitions and correlation rules. The system learns from detected attacks and adjusts its detection parameters, improving precision over time while maintaining rapid response through the established tag-based framework.
3Ease of operation
If PowerShell and legitimate tools are used for dynamic code creation and remote administration, then system functionality is maintained, but these same tools enable targeted attacks to evade detection
Solution Approach 1:
The patent introduces tags as an intermediary layer between legitimate tool usage and attack detection. Instead of blocking PowerShell or remote administration tools, the system attaches behavioral tags to their operations and uses tag correlation to identify malicious patterns. This allows legitimate functionality to continue while enabling detection of attacks that use these tools.
Solution Approach 2:
The patent changes the detection parameter from binary (malicious/legitimate) to multi-dimensional tagging. Each tool invocation is tagged with multiple attributes (tool type, behavior pattern, context, frequency), allowing the system to distinguish between legitimate administrative operations and malicious attacks using the same tools based on the combination and pattern of tags rather than simple presence/absence.
Data Source
AI summary
Disclosed are systems and methods of adding tags for use in detecting computer attacks. In one aspect, the system comprises a computer protection module configured to: receive a security notification, extract an object from the security notification, search for the extracted object in a threat database, add a first tag corresponding to the extracted object in the threat database only when the extracted object is found in the threat database, search for signs of suspicious activity in a database of suspicious activities based on the received security notification and the added first tag, and when at least one sign of suspicious activity is found, extract a second tag from the database of suspicious activities and add the second tag to an object database, wherein the object database is used for identifying signature of targeted attacks based on security notifications, objects, first tags and second tags.