Malicious activity detection by modeling end-point events as sequences

Patent metadata

Field	Value
Publication number	US-12585772-B2
Application number	US-202318470237-A
Country	US
Kind code	B2
Filing date	Sep 19, 2023
Priority date	Sep 19, 2023
Publication date	Mar 24, 2026
Grant date	Mar 24, 2026

Abstract

Systems and methods for detecting malicious activity on an endpoint, the endpoint having executing processes, including tracking behavior of executing processes, generating a provenance graph to group the behavior events, transforming the provenance graph into a sequence of behavior events, training a sequence classification machine learning model based on the sequence of behavior events, processing a sequence of test behavior events using the sequence classification machine learning model to generate a probability of maliciousness, and alerting for malicious activity when the probability of maliciousness for the sequence of test behavior events is greater than a threshold.

First claim

The invention claimed is:

1 . A method of detecting malicious activity on a computer system, the computer system having a plurality of processes executing on the computer system, the method comprising:
tracking behavior of the plurality of processes, wherein each of the plurality of processes includes a plurality of behavior events in interacting with the computer system, wherein the plurality of processes includes a sequential chain including a first process associated with a first executable and a second process associated with a second executable, wherein the first executable and the second executable are different, and wherein the plurality of behavior events includes an event originating from the first process and an event originating from the second process; generating at least one provenance graph to group the plurality of behavior events, wherein the plurality of behavior events include at least two processes running in parallel; transforming at least one provenance graph into a sequence of behavior events; training a sequence classification machine learning model based on the sequence of behavior events, wherein the sequence of behavior events are derived from the at least one provenance graph; processing a sequence of test behavior events using the sequence classification machine learning model to generate a probability of maliciousness; and alerting for malicious activity when the probability of maliciousness for the sequence of test behavior events is greater than a threshold, wherein the threshold includes a trend of maliciousness, and wherein alerting for malicious activity includes evaluating, against the trend of maliciousness, the probability of maliciousness and a plurality of probabilities of maliciousness for a plurality of other sequences of event behaviors to determine an increasing probability of maliciousness over time based on a relationship between the probability of maliciousness and at least one of the plurality of probabilities of maliciousness for the plurality of other sequences of event behaviors, wherein at least one of the sequence of test behavior events or the plurality of other sequences of event behaviors are undetected as malicious alone.

2 . The method of claim 1 , wherein the plurality of behavior events includes at least one of a process start, a file system access, a network connection, or a registry access.

3 . The method of claim 1 , further comprising:
determining security-relevant features for each event in the plurality of behavior events; and representing the security-relevant features for each event in the plurality of behavior events as a high-dimensional vector.

4 . The method of claim 1 , further comprising determining metadata for each of the plurality of behavior events, wherein generating the at least one provenance graph includes using the metadata.

5 . The method of claim 1 , wherein transforming the at least one provenance graph into the sequence of behavior events includes:
gathering all of the plurality of behavior events from a particular provenance graph; ordering all of the plurality of behavior events from the particular provenance graph according to timestamps; and creating a linear list of all of the plurality of behavior events.

6 . The method of claim 1 , wherein the sequence of behavior events is created after each new process start.

7 . The method of claim 1 , further comprising randomly selecting an additional event to serve as a starting point for the sequence of behavior events.

8 . The method of claim 1 , wherein the tracking the behavior of the plurality of processes includes at least one of monitoring a kernel API call or an operating system call.

9 . The method of claim 1 , further comprising determining the malicious activity as one of a plurality of malware categories.

10 . A system for detecting malicious activity on an endpoint, the endpoint having a plurality of executing processes, the system comprising:
at least one processor operably coupled to memory; instructions that, when executed by the at least one processor, cause the at least one processor to implement:
a monitoring engine configured to monitor behavior of the plurality of executing processes, wherein each of the plurality of executing processes includes a plurality of behavior events in interacting with the endpoint, wherein the plurality of executing processes includes a sequential chain including a first process associated with a first executable and a second process associated with a second executable, wherein the first executable and the second executable are different, and wherein the plurality of behavior events includes an event originating from the first process and an event originating from the second process,
a graphing engine configured to generate at least one provenance graph to group the plurality of behavior events, wherein the plurality of behavior events include at least two processes running in parallel,
a representation engine configured to transform at least one provenance graph into a sequence of behavior events,
a training engine configured to train a sequence classification machine learning model based on the sequence of behavior events, wherein the sequence of behavior events are derived from the at least one provenance graph,
the sequence classification machine learning model configured to process a sequence of test behavior events to generate a probability of maliciousness, and
a detection engine configured to alert for malicious activity when the probability of maliciousness for the sequence of test behavior events is greater than a threshold, wherein the threshold includes a trend of maliciousness, and wherein alerting for malicious activity includes evaluating, against the trend of maliciousness, the probability of maliciousness and a plurality of probabilities of maliciousness for a plurality of other sequences of event behaviors to determine an increasing probability of maliciousness over time based on a relationship between the probability of maliciousness and at least one of the plurality of probabilities of maliciousness for the plurality of other sequences of event behaviors, wherein at least one of the sequence of test behavior events or the plurality of other sequences of event behaviors are undetected as malicious alone.

11 . The system of claim 10 , wherein the representation engine is further configured to:
determine security-relevant features for each event in the plurality of behavior events; and represent the security-relevant features for each event in the plurality of behavior events as a high-dimensional vector.

12 . The system of claim 10 , wherein the monitoring engine is further configured to determine metadata for each of the plurality of behavior events, and wherein the graphing engine is further configured to generate the at least one provenance graph using the metadata.

13 . The system of claim 10 , wherein the representation engine is configured to transform the at least one provenance graph into the sequence of behavior events including:
gathering all of the plurality of behavior events from a particular provenance graph;
ordering all of the plurality of behavior events from the particular provenance graph according to timestamps; and
creating a linear list of all of the plurality of behavior events.

14 . The system of claim 10 , wherein the representation engine is further configured to create the sequence of behavior events after each new process start.

15 . The system of claim 10 , wherein the representation engine is further configured to create the sequence

Assignees

• Acronis Int Gmbh

Inventors

• Wuest Candid
• Gysel Philipp
• Divakaran Dinil Mon
• Ustyuzhanin Andrey
• Nwafor Kenneth
• Bell Serg
• Protasov Stanislav

Classifications

• G06N3/047

  Probabilistic or stochastic networks · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06N20/00

  Machine learning · CPC title

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title