Intrusion Detection via Thread Trace Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection systems face challenges in accurately identifying malicious behavior in multi-threaded software due to dynamic thread identifiers and interleaved system calls, leading to high false positive and false negative rates, as they struggle to define acceptable behavior precisely and map thread behaviors across multiple runs.
Innovation Solution
A method involving running a multi-thread computer program to record system calls, creating a database of reference threads, and using an optimization function to map test threads to reference threads, flagging unmatched threads for security actions, thereby isolating thread behaviors and enhancing detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional intrusion detection systems monitor system calls in multi-threaded software, then they can identify malicious behavior, but they suffer from high false positive and false negative rates due to dynamic thread identifiers and interleaved system calls
Solution Approach 1:
The patent introduces thread trace information as an intermediary element that mediates between the dynamic thread identifiers and the system call sequences. This thread trace information serves as a stable mapping key that connects test thread behaviors to reference thread behaviors, resolving the precision loss caused by dynamic identifier changes.
Solution Approach 2:
The patent performs preliminary actions by collecting and storing thread trace information during the reference execution phase before conducting the actual intrusion detection. This preliminary collection of thread-to-system-call mappings enables accurate comparison during test executions without suffering from dynamic identifier changes.
2Adaptability or versatility
If intrusion detection systems attempt to map thread behaviors across multiple runs, then they can detect deviations, but they struggle to define acceptable behavior precisely due to dynamic thread identifiers
Solution Approach 1:
Thread trace information acts as a mediator that enables adaptable mapping between threads across multiple runs while maintaining precision. Instead of directly matching dynamic thread identifiers, the system uses thread trace information as a stable intermediary that preserves the relationship between threads and their system call sequences across different executions.
3Measurement precision
If the system records system calls for each thread separately, then it can isolate thread behaviors for accurate detection, but it increases the complexity of data management and mapping
Solution Approach 1:
The patent merges thread identification information with system call sequence data into a unified thread trace information structure. This combination reduces data management complexity by eliminating the need for separate thread identifier tracking while maintaining precise thread behavior isolation through the integrated trace data.
Data Source
Figure 1A~1B
Figure 2
Figure 3
AI summary
According to an example aspect of the present invention, there is provided a method, comprising running a multithread computer program and recording system calls thereby made to produce a test set of threads with their associated system calls, retrieving a mapping from the threads of the test set to reference threads of a database of reference threads, attempting to map, using the mapping, the threads of the test set to the reference threads of the database, and responsive to a first thread from among the threads of the test set not mapping to the reference threads of the database, flagging the first thread for a security action.