Deep Learning Threat Detection via Event Sequence Aggregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional endpoint security platforms struggle to effectively detect sophisticated threats and malicious behaviors by analyzing isolated signals over time, leading to deficiencies in identifying potentially malicious activity among endpoints or within networks.
Innovation Solution
The implementation of a system that aggregates process data from client computers with other signals, organizes it as a sequence of events, and feeds it into a trained deep learning model to evaluate the likelihood of malicious activity, triggering security risk mitigation actions when a predetermined alert threshold is exceeded.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional heuristic or machine learning models analyze isolated signals to detect malicious behavior, then the detection system is simple and fast, but the detection precision is insufficient for sophisticated threats
Solution Approach 1:
The patent combines multiple isolated security signals into a unified sequence of events representation that captures temporal relationships and contextual information. This merging approach allows the system to analyze signals collectively rather than in isolation, improving detection precision for sophisticated threats while maintaining a manageable system architecture through the use of a consolidated event sequence framework.
Solution Approach 2:
The patent introduces a temporal dimension by organizing signals into chronological sequences of events with associated metadata. This dimensional transformation enables the detection system to analyze not only what signals occur but also when and in what order they occur, significantly improving detection precision for complex attack patterns without proportionally increasing system complexity.
2Measurement precision
If multiple signals are analyzed together to detect sophisticated threats, then the detection precision improves, but the processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary organization of security signals into structured event sequences with metadata extraction and temporal ordering before the actual detection analysis. This pre-processing step consolidates raw signals into a standardized format that can be efficiently processed by detection models, reducing the computational burden during real-time analysis and minimizing processing time while maintaining high detection precision.
3Reliability
If conventional methods evaluate multiple signals at different times, then the ability to detect sophisticated threats improves, but the system remains deficient in comprehensive threat identification
Solution Approach 1:
The patent implements a dynamic analysis framework that adapts the evaluation of event sequences based on detected patterns and contextual information. The system can adjust its analysis depth, focus on specific event types, or modify detection thresholds dynamically, allowing it to achieve high reliability for threat detection while managing analysis complexity through adaptive resource allocation and context-aware processing.
Data Source
AI summary
Embodiments of the present disclosure provide systems, methods, and non-transitory computer storage media for identifying malicious behavior using a trained deep learning model. At a high level, embodiments of the present disclosure utilize a trained deep learning model that takes a sequence of ordered signals as input to generate a score that indicates whether the sequence is malicious or benign. Initially, process data is collected from a client. After the data is collected, a virtual process tree is generated based on parent and child relationships associated with the process data. Subsequently, embodiments of the present disclosure aggregate signal data with the process data such that each signal is associated with a corresponding process in a chronologically ordered sequence of events. The ordered sequence of events is vectorized and fed into the trained deep learning model to generate a score indicating the level of maliciousness of the sequence of events.