Workload Pattern Detection Through Instruction Distributions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to effectively detect and mitigate malicious processes in distributed computing environments, particularly in the face of evolving attack strategies such as distributed denial of service attacks, where malicious actors exploit multiple accounts to compromise system security.
Innovation Solution
A machine learning-based model, such as a neural network, is trained to classify instructions from processes, generating probabilities of malicious activity, and restricts processes exceeding a threshold, thereby enhancing detection and mitigation of malicious code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional sequential pattern matching is used to detect malicious processes, then detection simplicity is maintained, but detection accuracy deteriorates due to evolving attack strategies
Solution Approach 1:
The patent transforms the detection approach by changing the parameters being analyzed from sequential instruction patterns to instruction distribution statistics. Instead of examining the order and sequence of instructions, the system analyzes frequency distributions, entropy, and statistical properties of instruction sets, which fundamentally alters the detection space and improves accuracy against obfuscated malware
Solution Approach 2:
The patent replaces traditional mechanical pattern-matching systems with machine learning models. Neural networks and other ML algorithms substitute for rule-based sequential analysis, enabling the system to learn complex patterns in instruction distributions that are invisible to traditional methods while adapting to evolving attack strategies
2Reliability
If comprehensive instruction analysis is performed on all processes, then detection reliability is improved, but system performance deteriorates due to computational overhead
Solution Approach 1:
The patent applies partial action by analyzing only the statistical distribution properties of instructions rather than every individual instruction's semantic meaning and execution context. This selective analysis of key distributional features maintains detection reliability while significantly reducing computational overhead compared to comprehensive instruction-by-instruction analysis
Solution Approach 2:
The patent segments the analysis process into distinct statistical features (frequency distributions, entropy measures, instruction type proportions) that can be computed independently and efficiently. This segmentation allows parallel processing and optimization of individual feature extraction, improving overall system performance while maintaining comprehensive detection coverage
3Adaptability or versatility
If machine learning models are used to analyze instruction distributions, then adaptability to new threats is improved, but implementation complexity worsens due to model training and deployment requirements
Solution Approach 1:
The patent applies preliminary action by pre-training machine learning models on extensive datasets of benign and malicious instruction distributions before deployment. The models are prepared in advance with learned patterns of malicious behavior, enabling rapid adaptation to new threats without requiring complex real-time training infrastructure when deployed in production environments
Data Source
AI summary
A computer-implemented method, computer program product and computer system are provided. A processor retrieves instructions for a plurality of processes. A processor generates a sample of the instructions for the plurality of processes. A processor determines a probability that the sample includes instructions from malicious processes. A processor, in response to the probability exceeding a threshold value, restricts one or more aspects of operation for at least one process of the plurality of processes.