Trusted Process Anomaly Detection with Markov Behavior Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious behavior in trusted processes are ineffective in identifying anomalies and vulnerabilities, particularly for previously unknown threats, due to the reliance on signature and heuristic analysis.
Innovation Solution
A system utilizing a Markov chain-based basic behavior model in conjunction with machine learning techniques to monitor and analyze the execution of trusted processes, assigning weight coefficients to events, and using a machine learning model to detect anomalies based on predefined thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature and heuristic analysis methods are used to detect malicious behavior, then detection capability for known threats is maintained, but detection accuracy for previously unknown threats deteriorates
Solution Approach 1:
The system performs preliminary action by collecting and analyzing behavior logs during a training phase before actual anomaly detection is needed. Behavior models are pre-trained using collected data, including weight coefficients for different events, so that when unknown threats appear, the system already has a baseline of normal behavior to compare against, enabling detection without requiring pre-existing signatures
Solution Approach 2:
The system implements feedback by continuously monitoring process behavior, comparing it against established behavior models, and using the results to refine detection accuracy. The behavior models are updated based on collected behavior logs, creating a feedback loop that improves the system's ability to detect both known and unknown threats over time
2Reliability
If traditional detective measures are used to identify malicious activities, then implementation simplicity is maintained, but detection effectiveness against camouflaged threats deteriorates
Solution Approach 1:
The system introduces an intermediary layer - behavior models with weight coefficients - that mediates between simple event monitoring and complex threat detection. These models act as intermediaries that translate raw process events into meaningful anomaly scores, enabling effective detection of camouflaged threats without requiring the system to implement complex analysis algorithms for every event
Solution Approach 2:
The system applies parameter changes by assigning different weight coefficients to various events based on their significance. Instead of treating all events equally or using fixed thresholds, the system dynamically adjusts parameters (weight coefficients) for different events based on learned behavior patterns, enabling more nuanced and effective detection of malicious activities that traditional fixed-threshold methods miss
3Measurement precision
If comprehensive behavior monitoring is implemented to detect all anomalies, then detection coverage is improved, but computational overhead increases
Solution Approach 1:
The system extracts only the most relevant features and events for anomaly detection by using pre-trained behavior models that identify significant events. Instead of analyzing all possible process behaviors equally, the system extracts and focuses on events with higher weight coefficients that are more indicative of anomalies, reducing computational overhead while maintaining detection coverage
Solution Approach 2:
The system applies partial action by monitoring and analyzing only the portion of process behavior that deviates from normal patterns, as identified by the behavior models. Rather than comprehensively analyzing every event with equal depth, the system focuses computational resources on events that show anomalous characteristics, achieving effective detection with reduced computational overhead
Data Source
AI summary
Disclosed are system and method for training a machine learning (ML) model for detecting anomalies in the behavior of a trusted process, the method comprising: collecting information about events occurring during the execution of the trusted process, wherein the information comprises a behavior log; analyzing the behavior log to identify events that occurred and to identify parameters of the occurred events; requesting statistical data related to an operation of the trusted process; assigning a weighted coefficient to each event from the behavior log; generating a basic behavior model represented by a Markov chain; and training the ML model based on detected event parameters.