Targeted Attack Identification via Malicious Activity Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security mechanisms are inadequate in identifying and mitigating targeted attacks, which often involve low-prevalence malicious activities concentrated on specific clusters or groups within an organization, as they continue to evolve and adapt tactics.
Innovation Solution
A computing system architecture that includes a monitored computing system, a targeted attack identification system, and a remedial action system, which uses malicious activity detection, clustering logic, and prevalence filtering to identify targeted attacks and generate control signals for remedial actions, such as inhibiting future attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If basic anti-malware and security mechanisms are deployed, then commodity attacks are effectively blocked, but targeted attacks with specific organization focus remain undetected
Solution Approach 1:
The system segments attack data by clustering targets based on characteristics such as organization, department, or user role. This segmentation allows the system to identify patterns specific to targeted attacks within subsets of data, improving detection accuracy without requiring a complete redesign of security mechanisms.
Solution Approach 2:
The system introduces an intermediary analysis layer that processes malicious activity data through clustering algorithms and prevalence filtering. This intermediary layer bridges basic security mechanisms and advanced targeted attack detection, enabling enhanced detection capability while maintaining system simplicity.
2Productivity
If security mechanisms focus on high-prevalence attacks, then common threats are addressed, but low-prevalence targeted attacks are overlooked
Solution Approach 1:
The system changes the detection parameter from attack prevalence frequency to attack concentration distribution. By analyzing the distribution of attacks across target clusters and identifying statistical outliers, the system detects low-prevalence targeted attacks that would otherwise be overlooked in favor of high-prevalence common attacks.
3Adaptability or versatility
If attackers adapt tactics based on knowledge gain, then attack effectiveness increases, but detection capability remains static
Solution Approach 1:
The system dynamically updates target cluster definitions and attack detection criteria based on analyzed malicious activity data. As attackers adapt their tactics, the system learns from detected patterns and adjusts its clustering and prevalence filtering parameters, maintaining detection capability against evolving attack strategies.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Malicious activity data is obtained, that is indicative of attempted attacks on a computing system. Clusters of targets are identified and it is determined whether the malicious activity preferentially targets one cluster of targets over other. Also, low prevalence attacks are identified and it is determined whether a low prevalence attack has a high concentration in one or more of the target clusters. If the malicious activity either preferentially targets a cluster, or a low prevalence attack has a high concentration in a cluster, then the attack is identified as a targeted attack, so that remediation steps can be taken.