Threat Detection System Using Behavioral Profile Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems fail to detect malicious modifications in software applications effectively, especially in supply chain attacks, leading to undetected threats as they consider software from known vendors as clean by default, even if modified with malicious code during the development process.
Innovation Solution
A system that generates and compares behavioral profiles of multiple software versions to identify abnormal changes, using behavioral data analysis and machine learning to detect anomalous modifications, and alerts for potential threats, with data stored in a database for future reference.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If security applications consider software from known vendors as clean by default, then false alarms are reduced and performance is improved, but malicious modifications in software cannot be detected
Solution Approach 1:
The system creates behavioral profiles of software applications in advance, establishing a baseline of normal behavior before deployment. This preliminary characterization enables the system to detect deviations caused by malicious modifications without requiring intensive real-time analysis of every software action, thus maintaining high performance while improving detection reliability.
Solution Approach 2:
The patent replaces traditional signature-based detection mechanisms with behavior-based detection. Instead of relying on static code analysis or vendor reputation, the system monitors dynamic behavioral patterns and compares them against established profiles, enabling detection of previously unseen malicious modifications while maintaining system performance.
2Productivity
If software is widely distributed within the organization without close vetting, then deployment efficiency is improved, but supply chain attacks cannot be detected
Solution Approach 1:
Behavioral profiles are created and stored in advance during software development or initial deployment. When the same software is distributed widely across the organization, these pre-established profiles enable rapid automated verification without requiring close vetting of each deployment instance, thus maintaining deployment speed while detecting malicious modifications.
Solution Approach 2:
The system creates copies of behavioral profiles from trusted software versions and uses these copies to verify subsequent deployments. Instead of re-analyzing each software instance, the system compares behavior against the stored profile copy, enabling rapid widespread distribution with security verification.
3Reliability
If behavioral profiles of multiple software versions are analyzed and compared, then malicious modifications are detected, but system complexity increases
Solution Approach 1:
The system extracts only the essential behavioral characteristics and key performance indicators from software execution, storing them in condensed behavioral profiles. This extraction of critical features rather than complete behavioral data reduces the complexity of storage, comparison, and analysis while maintaining the ability to detect malicious modifications.
Solution Approach 2:
The system transforms complex behavioral data into standardized parameters and metrics that facilitate efficient comparison across software versions. By changing the representation of behavioral data into comparable parameters, the system reduces analysis complexity while maintaining detection reliability.
Data Source
AI summary
There is provided a method of detecting a threat against a computer system. The method includes monitoring installation and operation of multiple different versions of the same application in a computer system; analysing evolutionary changes between the behaviours of the different versions of the same application; detecting and monitoring a new version of the same application in a computer system; monitoring the behavior of the computer system to detect one or more procedures of the monitored application that do not match expected behaviors of the monitored application on the basis of the analysis; and upon detection of one or more procedures not matching the expected behaviors of the monitored application, identifying the monitored application as malicious or suspicious.