Threat Detection via Static and Behavioral Analysis Synergy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face high false-positive rates in threat detection due to the limitations of static file analysis and behavioral analysis, with static file detection being prone to false positives and behavioral detection requiring extended execution of malware to gather sufficient indicators.
Innovation Solution
A network security platform that synergistically combines static file analysis and behavioral analysis by using a static analysis threshold and behavioral weighting factors to determine malicious intent, allowing for real-time dynamic analysis only when static analysis scores are below a threshold, thereby reducing false positives and enhancing detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If static file analysis is used for threat detection, then detection speed is improved, but false positive rate increases
Solution Approach 1:
The patent combines static file analysis with behavioral analysis to create a hybrid detection system. The static analysis component provides rapid initial assessment while the behavioral analysis component validates suspicious activities, thereby maintaining fast detection speed while reducing false positives through multiple verification layers.
Solution Approach 2:
The detection process is segmented into two phases: an initial static analysis phase for quick screening, and a subsequent behavioral analysis phase for detailed verification of suspicious files. This segmentation allows most files to be processed quickly through static analysis while only potentially malicious files undergo the more time-consuming behavioral analysis.
2Reliability
If behavioral analysis is used to reduce false positives, then detection accuracy is improved, but execution time increases
Solution Approach 1:
Static file analysis is performed as a preliminary action before behavioral analysis. This preliminary screening identifies and filters out benign files based on static characteristics, allowing the system to proceed directly to behavioral analysis only for files that exhibit suspicious static features, thereby reducing overall execution time while maintaining high detection accuracy.
Solution Approach 2:
The system applies behavioral analysis selectively rather than universally - only to files that pass the static analysis threshold for suspicion. This partial application of the more accurate but time-consuming behavioral analysis method optimizes the balance between detection accuracy and execution time by avoiding unnecessary analysis of benign files.
3Measurement precision
If more behavioral indicators are collected to reduce false positives, then detection accuracy is improved, but malware execution duration increases
Solution Approach 1:
Static file analysis serves as a preliminary filtering mechanism that identifies files requiring detailed behavioral monitoring. By pre-selecting suspicious files based on static characteristics, the system can focus behavioral indicator collection on a smaller subset of files, reducing the overall duration of malware execution while maintaining high detection precision through targeted analysis.
Data Source
AI summary
Systems and methods are described for synergistically combining static file based detection and behavioral analysis to improve both threat detection time and accuracy. An endpoint security solution running on an endpoint device generates a static analysis score by performing a static file analysis on files associated with a process initiated on the endpoint device. When the static analysis score meets or exceeds a static analysis threshold, then a network security platform treats the process as malicious and blocks execution of the process. When the static analysis score is less than the static analysis threshold, then the endpoint security solution obtains a dynamic analysis score for the process. The network security platform treats the process as malicious and causes execution of the process to be blocked based on a function of the static analysis score and the dynamic analysis score.