Automated Thread Security Risk Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional endpoint security approaches face challenges in detecting file-less malware attacks, such as those involving injected shellcode, as they rely on manual memory scans and lack real-time contextual information, leading to delayed detection of security risks.
Innovation Solution
An automated method for detecting user device security risks by obtaining and processing information about running processes, loaded images, and created threads, identifying potential security threats in real-time, and performing automated actions in response.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual memory scans are performed to detect malicious threads, then detection accuracy can be maintained, but detection speed and real-time capability deteriorate
Solution Approach 1:
The system performs preliminary actions by continuously monitoring and logging thread creation events, image loading events, and process information in real-time before attacks occur. This pre-collection of contextual data enables immediate analysis when security events happen, eliminating the need for manual memory scans while maintaining detection accuracy through pre-prepared contextual information.
Solution Approach 2:
The system introduces an intermediary mechanism that captures and stores contextual information (thread creation events, image loading events, process information) between the actual security event and the detection process. This intermediary layer provides ready-to-analyze data with contextual relationships, enabling fast automated detection without sacrificing accuracy that would otherwise require manual scanning.
2Productivity
If automated real-time monitoring of threads and images is implemented, then detection speed and contextual information improve, but system complexity increases
Solution Approach 1:
The system achieves multi-functionality by using a unified monitoring framework that simultaneously tracks thread creation events, image loading events, and process information through common data structures and event handling mechanisms. This universal approach consolidates multiple monitoring functions into one system, improving detection efficiency while managing complexity through shared infrastructure rather than separate specialized systems.
Solution Approach 2:
The system manages complexity by changing parameters from manual, on-demand scanning to automated, event-driven monitoring with configurable thresholds and filters. By adjusting monitoring parameters and using standardized event formats, the system achieves high detection efficiency while keeping the implementation manageable through parameter-based control rather than complex hard-coded logic.
3Loss of information
If contextual information about threads and images is collected and analyzed, then detection accuracy and real-time capability improve, but processing overhead increases
Solution Approach 1:
The system extracts only the essential contextual information needed for detection (thread creation events, image loading events, process information) from the vast amount of system data. By selectively extracting and storing only relevant parameters and relationships, the system maintains comprehensive contextual information availability while minimizing processing overhead through focused data collection rather than analyzing all system data.
Data Source
AI summary
Methods, apparatus, and processor-readable storage media for automated detection of user device security risks related to process threads and corresponding activity are provided herein. An example computer-implemented method includes obtaining information pertaining to processes running on a user device; obtaining information pertaining to images loaded into at least one memory associated with at least one of the processes running on the user device; obtaining information pertaining to threads created in connection with at least one of the processes running on the user device; automatically identifying at least one of the threads as a security risk by processing the information pertaining to the images and the information pertaining to the threads; and performing at least one automated action based on the identification of at least one of the one or more threads as a security risk.