Telemetry Tree Analysis for Malicious Activity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Anomaly detection systems face challenges in accurately and efficiently identifying potentially malicious processes on computers, as they often require extensive resource usage and may not differentiate between anomalous and malicious activities effectively.
Innovation Solution
A system that analyzes telemetry trees to determine anomaly scores by querying historical telemetry data, using a non-relational database to quickly identify potentially malicious relationships and perform corrective actions, such as terminating processes or flagging them for further evaluation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anomaly detection systems analyze telemetry data to identify malicious processes, then detection accuracy is improved, but resource usage increases
Solution Approach 1:
The system segments the telemetry analysis by dividing it into relationship identification, anomaly scoring, and corrective action phases. It further segments the telemetry data into individual relationships between telemetry types and values, allowing selective analysis of only those relationships that deviate from historical patterns, thereby reducing overall resource consumption while maintaining detection accuracy.
Solution Approach 2:
The system performs preliminary action by establishing a baseline of historical telemetry relationships before analyzing new data. It pre-computes expected relationships between telemetry types and values, so that during actual detection, only deviations from this pre-established baseline need to be analyzed, significantly reducing the computational resources required for real-time detection.
2Reliability
If anomaly detection systems evaluate all processes for malicious activity, then detection completeness is improved, but processing time increases
Solution Approach 1:
The system applies local quality by focusing detection efforts only on specific relationships that exhibit anomalous characteristics rather than uniformly analyzing all processes. It identifies relationships between specific telemetry types and values that deviate from historical patterns and directs detailed analysis only to these localized anomalies, maintaining detection completeness for malicious activities while reducing overall processing time.
Solution Approach 2:
The system performs partial action by analyzing only the portion of telemetry data that contains potential anomalies rather than evaluating all processes in detail. It uses anomaly scoring to identify relationships that warrant further investigation, applying exhaustive analysis only to those specific cases where the anomaly score indicates potential malicious activity, thus reducing processing time while maintaining detection completeness.
3Productivity
If anomaly detection systems terminate anomalous processes automatically, then response effectiveness is improved, but false positive rate increases
Solution Approach 1:
The system implements feedback by using historical telemetry data to continuously refine anomaly detection thresholds and scoring mechanisms. It monitors the outcomes of corrective actions and adjusts the anomaly scoring algorithm based on feedback from false positives and true detections, thereby improving response effectiveness while reducing the false positive rate over time through iterative optimization.
Solution Approach 2:
The system applies parameter changes by dynamically adjusting anomaly score thresholds based on historical data patterns and the specific context of detected anomalies. Rather than using fixed thresholds, it modifies the criteria for what constitutes an anomalous relationship based on learned patterns from historical telemetry, allowing more accurate differentiation between malicious and benign processes, thus improving response effectiveness while reducing false positives.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for analyzing telemetry to detect anomalous activity. One of the methods includes accessing data describing a telemetry tree that includes a plurality of nodes and edges; querying, for each of the edges in the telemetry tree using at least one value for the edge from a number of values, historical telemetry data that quantifies an anomaly score for each value to determine whether a relationship indicated by the edge in the telemetry tree represents a potentially malicious relationship; and performing an action using a result of the querying of the historical telemetry data that indicates whether one of the anomaly scores indicates that the relationship indicated by the edge in the telemetry tree represents a potentially malicious relationship.