Threat Classifier Using Neural Network for Malicious Process Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current threat detection methods rely heavily on user input, which is time-consuming and prone to inaccuracies due to 'dialog fatigue' and lack of user expertise, and are hindered by the rapid evolution of malware, making it difficult to maintain effective white or black lists.
Innovation Solution
A computer-implemented method using a parameter collection module distributed to client processing systems to collect and scale data, which is then classified using a machine learning process, specifically an Artificial Neural Network, to generate a threat classifier that can automatically determine malicious processes, reducing the need for user intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user input is used to determine malicious actions, then user control and decision-making are maintained, but the process becomes time-consuming and users experience dialog fatigue leading to inaccurate decisions
Solution Approach 1:
The system performs self-service by automatically analyzing program actions and making threat determination decisions without requiring user input. The behavior-based threat detection software autonomously evaluates contextual information and determines whether actions are malicious, eliminating dialog fatigue and time-consuming user decisions while maintaining or improving detection accuracy.
Solution Approach 2:
The patent replaces the mechanical system of user interaction (manual decision-making) with an automated computational system. Instead of relying on users to analyze and decide on threat status, the system uses contextual analysis algorithms that automatically process program actions and determine maliciousness, substituting human cognitive processes with machine-based automated reasoning.
2Productivity
If white or black lists are generated to determine malicious actions, then automated threat classification is achieved, but rapid malware modifications render these lists ineffective
Solution Approach 1:
The system transitions from static white/black lists to dynamic contextual analysis. Instead of relying on fixed lists that must be manually updated, the software continuously evaluates the context of program actions in real-time, adapting its threat assessment based on current behavioral patterns and environmental factors, thereby remaining effective against rapidly evolving malware without requiring frequent list updates.
Solution Approach 2:
The patent changes the fundamental parameters of threat detection from signature-based matching (static lists) to contextual parameter analysis (dynamic evaluation). The system monitors multiple contextual parameters simultaneously and evaluates their relationships to determine threat status, allowing it to detect novel malware variants that do not match known signatures but exhibit suspicious contextual patterns.
3Measurement precision
If behavior-based analysis with contextual information is used, then accurate threat detection is achieved, but the system complexity increases
Solution Approach 1:
The system segments the complex threat detection task into manageable components: collecting contextual information about program actions, evaluating specific contextual parameters (such as file operations, network connections, registry modifications), and making determination decisions based on evaluated parameters. This segmentation allows the system to handle complexity through modular processing while maintaining high detection accuracy.
Data Source
AI summary
A computer-implemented method for generating a threat classifier is described. A parameter collection module is distributed to a plurality of client processing systems. The module comprises a set of rules to detect a behavior in the client processing systems. If one or more of the set of rules are satisfied, input data indicative of a plurality of client processing parameters is received. The input data is scaled to provide a plurality of parameter vectors. Each of the parameter vectors are classified as a threat or a non-threat. A machine learning process is performed on at least one of the classified parameter vectors. The threat classifier is generated from the machine learning process. The threat classifier is transferred to at least one client processing system. The threat classifier is configured to automatically determine if a process to be performed in a client processing system is malicious.