Detecting malicious activity on a computer system

Patent metadata

Field	Value
Publication number	US-11023576-B2
Application number	US-201816202149-A
Country	US
Kind code	B2
Filing date	Nov 28, 2018
Priority date	Nov 28, 2018
Publication date	Jun 1, 2021
Grant date	Jun 1, 2021

Abstract

An approach is provided for detecting a malicious activity on a computer system. First process trees are identified for computer processes that have been executed on a computer system. Each of the first process trees are vectorized. The vectorized first process trees are associated with respective labels. Each label represents an amount by which a respective vectorized process tree reflects the malicious activity. An artificial neural network is trained by using the vectorized first process trees and the associated labels as training input. After the training of the artificial neural network is completed, second process trees for currently executing computer processes are vectorized and provided as input vectors to the artificial neural network. Responsive to the artificial neural network providing an output indicating that a combination of the input vectors indicates the malicious activity, a remedial action is performed.

First claim

What is claimed is:

1. A computer-implemented method of detecting a malicious activity on a computer system, the method comprising:
identifying, by one or more processors, first process trees for a plurality of computer processes that have executed on a computer system;
vectorizing, by the one or more processors, each of the first process trees and associating, by the one or more processors, the vectorized first process trees with respective labels, each label representing an amount by which a respective vectorized process tree included in the vectorized first process trees reflects the malicious activity;
training, by the one or more processors, an artificial neural network by using the vectorized first process trees and the associated labels as training input;
vectorizing, by the one or more processors and after a completion of the training of the artificial neural network, second process trees for computer processes that are currently executing on the computer system, and providing, by the one or more processors, the vectorized second process trees as input vectors to the artificial neural network;
in response to the artificial neural network providing an output indicating that a combination of the input vectors indicates the malicious activity, performing, by the one or more processors, a remedial action for the malicious activity;
determining, by the one or more processors and during the training the artificial neural network, a language of a first computer process based on one or more computer-based actions indicated by one or more sub-trees within a first process tree included in the first process trees, the language of the first computer process including a specification of a first launching application and a first order of first tasks performed by the first computer process;
determining, by the one or more processors, that the language of the first computer process indicates the malicious activity;
determining, by the one or more processors, a language of a second computer process based on one or more other computer-based actions indicated by one or more other sub-trees within a second process tree included in the second process trees, the language of the second computer process including a specification of a second launching application and a second order of second tasks performed by the second computer process;
determining, by the one or more processors, that the language of the first computer process matches the language of the second computer process by determining that the first launching application matches the second launching application and the first order of the first tasks matches the second order of the second tasks, wherein the performing the remedial action is based on the language of the first computer process indicating the malicious activity and matching the language of the second computer process;
based on the language of the second computer process, generating, by the one or more processors and using a natural language generation engine, a text in a natural language that includes a description of the malicious activity based on the one or more other computer-based actions;
converting, by the one or more processors, the text into a voice message and sending the voice message to a human analyst, wherein the voice message includes the remedial action for the malicious activity; and
receiving, by the one or more processors, an approval of the remedial action, wherein the performing the remedial action is performed automatically in response to the receiving the approval.

2. The method of claim 1 , further comprising:
generating, by the one or more processors, an alert that includes the text in the natural language that includes the description of the malicious activity and sending the alert to another computer system for viewing by a human analyst, wherein the alert includes one or more remedial actions for the malicious activity.

3. The method of claim 1 , wherein vectorizing each of the first process trees includes mapping the first process trees to first text in the natural language, and wherein the vectorizing the second process trees includes mapping the second process trees to second text in the natural language.

4. The method of claim 1 , further comprising:
configuring, by the one or more processors, attributes of the remedial action in a policy; and
determining that an amount of risk associated with the malicious activity exceeds a threshold amount of risk, wherein the performing the remedial action is performed automatically based on the policy and the amount of risk exceeding the threshold amount of risk.

5. The method of claim 1 , wherein the performing the remedial action includes proactively preventing subsequent malicious activity by preventing a completion of a subsequent computer process that performs the subsequent malicious activity.

6. The method of claim 1 , further comprising:
providing at least one support service for at least one action selected from the group consisting of creating, integrating, hosting, maintaining, and deploying computer readable program code in a computer, the program code being executed by a processor of the computer to implement the identifying the first process trees, vectoring each of the first process trees, associating the vectorized first process trees with respective labels, training the artificial neural network, vectorizing the second process trees, providing the vectorized second process trees as the input vectors, performing the remedial action, determining the language of the first computer process, determining that the language of the first computer process indicates the malicious activity, determining the language of the second computer process, determining that the language of the first computer process matches the language of the second computer process, generating the text in the natural language, converting the text into the voice message, sending the voice message to the human analyst, and receiving the approval of the remedial action.

7. A computer program product for detecting a malicious activity on a computer system, the computer program product comprising:
a computer readable storage medium having computer readable program code stored on the computer readable storage medium, wherein the computer readable storage medium is not a transitory signal per se, the computer readable program code being executed by a central processing unit (CPU) of a first computer system to cause the first computer system to perform a method comprising:
identifying, by the first computer system, first process trees for a plurality of computer processes that have executed on a second computer system;
vectorizing, by the first computer system, each of the first process trees and associating, by the first computer system, the vectorized first process trees with respective labels, each label representing an amount by which a respective vectorized process tree included in the vectorized first process trees reflects the malicious activity;
training, by the first computer system, an artificial neural network by using the vectorized first process trees and the associated labels as training input;
vectorizing, by the first computer system and after a completion of the training of the artificial neural network, second process trees for computer processes that are currently executing on the second computer system, and providing, by the first computer system, the vectorized second process trees as input vectors to the artificial neural network;
in response to the artificial neural network providing an output indicating that a combination of the input vectors indicates the malicious activity, performing, by the first computer system, a remedial action for the malicious activity;
determining, by the first comput

Assignees

• IBM

Inventors

• Griffin Adam L
• Scott Christopher D
• Rudden Mary E
• Trim Craig M
• Childress Rhonda L

Classifications

• G06N3/048

  Activation functions · CPC title

• G06N3/042

  Knowledge-based neural networks; Logical representations of neural networks · CPC title

• G06N3/08

  Learning methods · CPC title

• G06N3/0499

  Feedforward networks · CPC title

• G06N3/09

  Supervised learning · CPC title