User-Mode Sensor Threat Detection with Synchronized Stack Traces
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing threat detection methods face inefficiencies due to unsynchronized collection of stack traces and system events, leading to high resource utilization and low detection rates, particularly when using kernel sensors that provide limited operational capabilities.
Innovation Solution
A system and method for threat detection that utilizes user mode sensors and kernel drivers to synchronize system events and stack traces, employing machine learning models for two levels of monitoring to enhance detection accuracy and reduce resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If stack traces are collected independently from system events, then collection simplicity is maintained, but resource utilization increases and detection accuracy decreases
Solution Approach 1:
The patent combines independent stack trace collection with system event monitoring into a unified synchronized collection mechanism. The kernel driver captures both stack traces and system events simultaneously, ensuring they are correlated by timestamp and process ID, thereby reducing resource overhead while improving detection accuracy.
Solution Approach 2:
The system performs preliminary synchronization of stack trace collection with system event monitoring before analysis begins. By pre-establishing the correlation framework and capturing data in sync, the system avoids the need for resource-intensive post-collection correlation processing.
2Reliability
If kernel sensors are used for threat detection, then detection capabilities are enhanced, but operational limitations increase
Solution Approach 1:
The patent implements a multi-level monitoring architecture where user-mode sensors perform initial filtering and event detection, while kernel-mode drivers provide deeper system-level analysis. This layered approach allows the system to leverage both user-mode flexibility and kernel-mode reliability, achieving comprehensive threat detection with broad operational capabilities.
3Reliability
If full stack traces are captured for all processes, then detection completeness is improved, but resource consumption increases
Solution Approach 1:
The patent applies local quality by capturing full stack traces selectively only for processes exhibiting suspicious behavior patterns detected by the user-mode sensor. For normal processes, minimal or no stack trace capture is performed. This targeted approach maintains detection completeness for threats while significantly reducing overall resource consumption.
Solution Approach 2:
The system performs partial action by capturing stack traces at different levels of detail based on suspicion level. For high-suspicion events, full stack traces are captured; for low-suspicion events, minimal or no capture occurs. This graduated approach optimizes the balance between detection completeness and resource usage.
Data Source
AI summary
Systems and methods for threat detection and analysis. A method includes monitoring at least one thread associated with at least one user process on a computing device. The method further includes detecting specific-system calls associated with at least one user process at user level. The specific-system calls are analyzed by applying a filter to system calls sequence feature sets associated with the specific-system calls for detecting one or more events of interest. A capture of a full stack trace of at least one user process is requested if the system calls sequence feature set is filtered and at least one event of interest is detected. A first level monitoring is provided to the computing device, which includes processing and analyzing the captured full stack trace by a machine learning (ML) stack trace analyzer to generate a first verdict for threat detection and analysis.