Patent Publication Number: US-11023576-B2

Title: Detecting malicious activity on a computer system

Description:
BACKGROUND 
     The present invention relates to computer security, and more particularly to malicious activity detection and remediation. 
     Known antivirus platforms include signature-based and/or heuristic-based programs used to prevent, detect, and remove malware. Trained professionals study malware and manually build a heuristic that can react to the threat. The AV-TEST organization registers over 250,000 new malicious programs every day. Conventional computer security techniques detect known cyber-attacks by using preconfigured tooling and can include collecting and analyzing data in log files from network devices, host assets, and operating systems. Conventional computer security techniques identify possible malicious activities by employing a rule-based or a statistical correlation engine to determine associations between events in a computer system, or by analyzing user activities and behaviors. 
     SUMMARY 
     In one embodiment, the present invention provides a computer-implemented method of detecting a malicious activity on a computer system. The method includes identifying, by one or more processors, first process trees for a plurality of computer processes that have executed on a computer system. The method further includes vectorizing, by the one or more processors, each of the first process trees and associating, by the one or more processors, the vectorized first process trees with respective labels. Each label represents an amount by which a respective vectorized process tree included in the vectorized first process trees reflects the malicious activity. The method further includes training, by the one or more processors, an artificial neural network by using the vectorized first process trees and the associated labels as training input. The method further includes vectorizing, by the one or more processors and after a completion of the training of the artificial neural network, second process trees for computer processes that are currently executing on the computer system. The method further includes providing, by the one or more processors, the vectorized second process trees as input vectors to the artificial neural network. The method further includes in response to the artificial neural network providing an output indicating that a combination of the input vectors indicates the malicious activity, performing, by the one or more processors, a remedial action for the malicious activity. 
     In another embodiment, the present invention provides a computer program product for detecting a malicious activity on a computer system. The computer program product includes a computer readable storage medium. Computer readable program code is stored in the computer readable storage medium. The computer readable storage medium is not a transitory signal per se. The computer readable program code is executed by a central processing unit (CPU) of a computer system to cause the computer system to perform a method. The method includes identifying, by the first computer system, first process trees for a plurality of computer processes that have executed on a second computer system. The method further includes vectorizing, by the first computer system, each of the first process trees and associating, by the first computer system, the vectorized first process trees with respective labels. Each label represents an amount by which a respective vectorized process tree included in the vectorized first process trees reflects the malicious activity. The method further includes training, by the first computer system, an artificial neural network by using the vectorized first process trees and the associated labels as training input. The method further includes vectorizing, by the first computer system and after a completion of the training of the artificial neural network, second process trees for computer processes that are currently executing on the second computer system. The method further includes providing, by the first computer system, the vectorized second process trees as input vectors to the artificial neural network. The method further includes in response to the artificial neural network providing an output indicating that a combination of the input vectors indicates the malicious activity, performing, by the first computer system, a remedial action for the malicious activity. 
     In another embodiment, the present invention provides a first computer system including a central processing unit (CPU); a memory coupled to the CPU; and a computer readable storage medium coupled to the CPU. The computer readable storage medium contains instructions that are executed by the CPU via the memory to implement a method of detecting a malicious activity on a second computer system. The method includes identifying, by the first computer system, first process trees for a plurality of computer processes that have executed on a second computer system. The method further includes vectorizing, by the first computer system, each of the first process trees and associating, by the first computer system, the vectorized first process trees with respective labels. Each label represents an amount by which a respective vectorized process tree included in the vectorized first process trees reflects the malicious activity. The method further includes training, by the first computer system, an artificial neural network by using the vectorized first process trees and the associated labels as training input. The method further includes vectorizing, by the first computer system and after a completion of the training of the artificial neural network, second process trees for computer processes that are currently executing on the second computer system. The method further includes providing, by the first computer system, the vectorized second process trees as input vectors to the artificial neural network. The method further includes in response to the artificial neural network providing an output indicating that a combination of the input vectors indicates the malicious activity, performing, by the first computer system, a remedial action for the malicious activity. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram of a system for detecting a malicious activity on a computer system, in accordance with embodiments of the present invention. 
         FIG. 2  is a flowchart of a process of detecting a malicious activity on a computer system, where the process is implemented in the system of  FIG. 1 , in accordance with embodiments of the present invention. 
         FIG. 3  is a block diagram of a computer included in the system of  FIG. 1  and that implements the process of  FIG. 2 , in accordance with embodiments of the present invention. 
     
    
    
     DETAILED DESCRIPTION 
     Overview 
     Conventional antivirus techniques are reactive and based on known samples of malware. These conventional techniques lack the ability to detect malicious activity that is not known and that indicates an increase in a threat level. Due to the significant number of new malicious programs being registered each day, manual registration and classification is not a sustainable approach. The time taken by an enterprise to react to malicious activity using conventional techniques is not close to a response time that would be required to safeguard information technology (IT) infrastructure. Malicious activity can affect thousands of servers and freeze or otherwise cripple computer systems within two or three hours, while sampling, submitting, creating, and distributing virus signature files may take days. Known manual threat analysis including incident triage, investigation and impact assessment, and remediation may take weeks or months to complete. Internal delays, corporate inefficiencies, and the need for executive approvals may add to the delays in responding to a cyberattack and increase the cost of the response. While the lengthy response to the cyberattack is occurring, a new variant of malware may be released by a command and control hacker team, which causes the cycle to repeat, causing additional costs and reputational damage. 
     Embodiments of the present invention address the unique challenges of the conventional computer security techniques by applying knowledge of an attack lifecycle to determine that a cyberattack is happening early in the phases of a model of cyber intrusion (hereinafter, referred to as a termination chain) based on an identification of an escalation of the threat. For example, an initial stage of the cyberattack is recognized and a remediation action is taken before the delivery, exploitation, installation, command and control, or actions on objective phase of the termination chain is completed, thereby minimizing the number of systems affected by the cyberattack. In one embodiment, new cyberattack methodologies are learned, and that learning is applied to previously unseen datasets. 
     Computer processes, such as launching applications and the order in which they execute, belong to the realm of unstructured and non-sequential data and can be analogized to a sentence in a natural language. A natural language sentence has multiple words strung together which require a syntactic disposition of nouns and verbs and other parts of speech. Specific parts of speech function as glue words that attach tokens with a higher semantic representation together in a coherent manner. Due to the complicated nature of a natural language, no single grammar can describe all possible variants. The analogous language of computer processes requires a syntactic and sematic grammatical order. Sequencing of computer processes may be capable of non-finite variation, but there are still meta-level (i.e., grammatical) requirements for invocation of the processes. In one embodiment, an augmented threat detection system learns the language of computer process execution and applies that learning to threat detection. 
     In one embodiment, an augmented threat response system generates a process tree, creates an embedding vector for each detailed process taxonomy of the process tree (i.e., vectorizes the process taxonomies), associates the taxonomies with running processes, and analyzes each process sub-tree and associated sub-trees to proactively determine whether the sub-trees represent a contextual sub-task that has the capability for malicious behavior (i.e., to recognize a threat vector). 
     In one embodiment, an augmented threat response system uses predictive models to analyze network traffic in real time to find imminent threats and allow immediate action. In one embodiment, the augmented threat response system mines historical information to find previously undetected malicious occurrences. 
     System for Detecting Malicious Activity 
       FIG. 1  is a block diagram of a system  100  for detecting a malicious activity on a computer system, in accordance with embodiments of the present invention. System  100  includes a computer  102  which executes a software-based malicious activity detection system  104 . Malicious activity detection system  104  receives process trees  106  that specify computer processes that were previously executed on one or more computers. Alternatively, malicious activity detection system  104  generates or identifies process trees  106  based on the computer processes that were previously executed. 
     Malicious activity detection system  104  uses a process tree vectorization tool  108  to generate an embedding vector for each of the process trees  106  (i.e., vectorizes each of the process trees  106 ). The embedding vectors are also referred to herein as vectorized process trees (not shown). Each process sub-tree included in the vectorized process trees represents a contextual sub-task that may have the capability for malicious behavior. An artificial neural network  110  receives the vectorized process trees from process tree vectorization tool  108  as training input for a training of the artificial neural network  110 . 
     After the training of the artificial neural network  110  is completed, malicious activity detection system  104  receives process trees  112  that specify other computer processes that are currently executing on another computer (not shown) and process tree vectorization tool  108  vectorizes process trees  112  to generate additional vectorized process trees. Process tree vectorization tool  108  sends the additional vectorized process trees as input vectors to artificial neural network  110 , which subsequently generates an output indicating that one or more of the additional vectorized process trees indicates a malicious activity  114  and generates remediation recommendation(s)  116  (i.e., recommendation(s) to correct or prevent computer system damage, disruption, or misappropriation based on malicious activity  114 ). 
     The functionality of the components shown in  FIG. 1  is described in more detail in the discussion of  FIG. 2  and  FIG. 3  presented below. 
     Process for Detecting Malicious Activity 
       FIG. 2  is a flowchart of a process of detecting a malicious activity on a computer system, where the process is implemented in the system of  FIG. 1 , in accordance with embodiments of the present invention. The process of  FIG. 2  starts at step  200 . In step  202 , malicious activity detection system  104  (see  FIG. 1 ) identifies first process trees  106  (see  FIG. 1 ) that specify computer processes that previously have been executed on one or more computer systems. 
     In step  204 , malicious activity detection system  104  (see  FIG. 1 ) vectorizes each process tree included in the first process trees  106  (see  FIG. 1 ) to generate vectorized first process trees. In one embodiment, process tree vectorization tool  108  (see  FIG. 1 ) performs step  204 . 
     In step  206 , malicious activity detection system  104  (see  FIG. 1 ) associates the vectorized first process trees with respective labels. Each label represents an amount by which a respective vectorized first process tree reflects (i.e., indicates) the malicious activity  114  (see  FIG. 1 ). 
     In step  208 , malicious activity detection system  104  (see  FIG. 1 ) trains artificial neural network  110  (see  FIG. 1 ) by using the vectorized first process trees generated in step  204  and the labels associated with the vectorized first process trees in step  206 . 
     Step  210  is performed after the training of the artificial neural network  110  (see  FIG. 1 ) is completed. In step  210 , malicious activity detection system  104  (see  FIG. 1 ) vectorizes second process trees  112  (see  FIG. 1 ), which specify computer processes that are currently being executed in computer  102  (see  FIG. 1 ) or in a computer (not shown in  FIG. 1 ) other than computer  102  (see  FIG. 1 ). The vectorizing in step  210  results in vectorized second process trees. In one embodiment, process tree vectorization tool  108  (see  FIG. 1 ) performs step  210 . 
     In one embodiment, malicious activity detection system  104  (see  FIG. 1 ) receives data specifying first process trees  106  (see  FIG. 1 ) and second process trees  112  (see  FIG. 1 ) from data flows from osquery, an endpoint detection and response system, or a threat intelligence feed. 
     In step  212 , malicious activity detection system  104  (see  FIG. 1 ) provides the vectorized second process trees as input vectors to artificial neural network  110 . In one embodiment, process tree vectorization tool  108  (see  FIG. 1 ) performs step  212 . 
     After step  212  and prior to step  214 , artificial neural network  110  (see  FIG. 1 ) provides an output indicating that a combination of the input vectors provided in step  212  indicates the malicious activity  114  (see  FIG. 1 ). In step  214 , responsive to artificial neural network  110  (see  FIG. 1 ) providing the aforementioned output, malicious activity detection system  104  (see  FIG. 1 ) generates and sends (or otherwise presents) remediation recommendation(s)  116  (see  FIG. 1 ) and/or performs remedial action(s) based on remediation recommendation(s)  116  (see  FIG. 1 ). 
     In one embodiment, malicious activity detection system  104  (see  FIG. 1 ) sends remediation recommendation(s)  116  (see  FIG. 1 ) to a human analyst for approval. Responsive to receiving the approval for one or more of the remediation recommendation(s)  116  (see  FIG. 1 ), malicious activity detection system  104  (see  FIG. 1 ) performs remedial action(s) to implement the approved remediation recommendation(s). 
     In one embodiment, performing the remedial action in step  214  includes malicious activity detection system  104  (see  FIG. 1 ) proactively preventing subsequent malicious activity in the computer system by preventing a completion of a subsequent computer process that performs the subsequent malicious activity. 
     After step  214 , the process of  FIG. 2  ends at step  216 . 
     The vectorizing or process trees in step  204  and step  210  creates embedding vectors (i.e., process embeddings) that provide a compact representation of computer processes and the relative meanings of the computer processes. The process embeddings are an improvement over sparse representations used in heuristic representation. In one embodiment, malicious activity detection system  104  (see  FIG. 1 ) learns the process embeddings from first and second process trees  106  and  112  (see  FIG. 1 ) and may reuse the process embeddings among projects. Alternatively, malicious activity detection system  104  (see  FIG. 1 ) learns the process embeddings as part of fitting a neural network on text data. In one embodiment, malicious activity detection system  104  (see  FIG. 1 ) uses an embedding layer for neural networks on the first and second process trees  106  and  112  (see  FIG. 1 ). In one embodiment, malicious activity detection system  104  (see  FIG. 1 ) requires that data from the first and second process trees  106  and  112  (see  FIG. 1 ) be integer encoded so that a unique integer represents each process. In one embodiment, this data preparation step is performed by an application programming interface (API) that tokenizes a text corpus (e.g., the Tokenizer API provided by the Keras open source neural network library). In one embodiment, malicious activity detection system  104  (see  FIG. 1 ) initializes an embedding layer with random weights and learns an embedding for all the processes in a training dataset. The embedding layer is defined as the first hidden layer of artificial neural network  110  (see  FIG. 1 ). The embedding layer specifies three arguments: 
     1. input_dim: the size of the vocabulary in the process tree data. For example, if the data is integer encoded to values in the range 0 to 10, inclusive, then the size of the vocabulary is 11 elements. 
     2. output_dim: the size of the vector space in which the computer processes will be embedded. Output_dim defines the size of output vectors from the embedding layer for each process. For example, output_dim can be 32, 100, or larger. 
     3. input length: the length of input sequences, as defined for any input layer of a Keras model or a similar model. For example, if all the computer processes in the process tree are comprised of 1000 elements, then input length is 1000. 
     In one embodiment, step  208  includes malicious activity detection system  104  (see  FIG. 1 ) (1) determining a language of a first computer process based on one or more computer-based actions indicated by one or more sub-trees within a first process tree included in the first process trees  106  (see  FIG. 1 ), (2) determining that the language of the first computer process indicates the malicious activity  114  (see  FIG. 1 ), (3) after the training of the artificial neural network is completed, determining a language of a second computer process based on one or more other computer-based actions indicated by one or more other sub-trees within a second process tree included in the second process trees  112  (see  FIG. 1 ), and (4) determining that the language of the first computer process matches the language of the second computer process and performing the remedial action(s) is based on the language of the first computer process (i) indicating the malicious activity  114  (see  FIG. 1 ) and (ii) matching the language of the second computer process. 
     In one embodiment, based on the language of the aforementioned second computer process, malicious activity detection system  104  (see  FIG. 1 ) uses a natural language generation engine to generate a text in a natural language that includes a description of the malicious activity  114  (see  FIG. 1 ) based on the one or more other computer-based actions and malicious activity detection system  104  (see  FIG. 1 ) generates an alert that includes the text in the natural language that includes the description of the malicious activity  114  (see  FIG. 1 ) and sends the alert to another computer system for viewing by a human analyst. The alert includes one or more remedial actions to address the malicious activity  114  (see  FIG. 1 ). 
     In one embodiment, based on the language of the aforementioned second computer process, malicious activity detection system  104  (see  FIG. 1 ) (1) uses a natural language generation engine to generate a text in a natural language that includes a description of the malicious activity based on the one or more other computer-based actions, (2) converts the text into a voice message, (3) sends the voice message to a computer system for presentation to a human analyst, where the voice message includes one or more remedial actions to address the malicious activity  114  (see  FIG. 1 ), and (4) receives an approval of the remedial action, where performing the remedial action(s) in step  214  is performed automatically in response to the step of receiving the approval. 
     In one embodiment, step  206  includes malicious activity detection system  104  (see  FIG. 1 ) mapping the first process trees to first text in a natural language, and step  210  includes malicious activity detection system  104  (see  FIG. 1 ) mapping the second process trees to second text in the natural language. 
     In one embodiment, malicious activity detection system  104  (see  FIG. 1 ) (1) configures attributes of the remedial action(s) in one or more policies and (2) determines that an amount of risk associated with the malicious activity exceeds a threshold amount of risk, where performing the remedial action(s) in step  214  is performed automatically based on (i) the one or more policies and (ii) the amount of risk exceeding the threshold amount of risk. 
     EXAMPLES 
     In the vectorization in steps  206  and  212  (see  FIG. 2 ), malicious activity detection system  104  (see  FIG. 1 ) analyzes data in a process tree included in first process trees  106  (see  FIG. 1 ) or second process trees  112  (see  FIG. 1 ) and determines whether a threat vector is present. As a first example, malicious activity detection system  104  (see  FIG. 1 ) determines that a process tree indicates the following computer process language: 
     User user 1  launches winword.exe 
     In the first example, malicious activity detection system  104  (see  FIG. 1 ) determines that the computer process language presented above is mapped to the following human language: 
     “user 1  has just started Microsoft® Word” 
     Microsoft is a registered trademark of Microsoft Corporation located in Seattle, Wash. 
     As a second example, malicious activity detection system  104  (see  FIG. 1 ) determines that a process tree indicates the following computer process language: 
     “User user 1  launches winword.exe and cmd.exe launches with elevated privileges in the same process tree. An unsigned dynamic link library (DLL) is loaded into lsass.exe.” 
     In the second example, malicious activity detection system  104  (see  FIG. 1 ) determines that the computer process language presented above is mapped to the following human language: 
     “Your PC user credentials have just been stolen by an attacker” 
     In the first and second examples presented above, malicious activity detection system  104  (see  FIG. 1 ) analyzes the processes as the processes are initiated and in the context of their associated process trees to determine whether there is a match to one of thirteen known methods of stealing user credentials from a Microsoft® Windows® system. Windows is a registered trademark of Microsoft Corporation. In the case of the second example presented above, malicious activity detection system  104  (see  FIG. 1 ) identifies suspicious activity and determines the correct termination point within the complexity of multiple process trees to halt suspicious activity (e.g., determine the point at which to shut down a computer process to avoid or minimize damage done by malicious activity that follows the identified suspicious activity). In the second example, malicious activity detection system  104  (see  FIG. 1 ) may determine that it is sufficient to terminate the command prompt as a remedial action because in previously analyzed process trees that included the launch of winword.exe without the cmd.exe being launched with elevated privileges (i.e., similar to the first example presented above) did not indicate a risk of a malicious activity. 
     In a third example, malicious activity detection system  104  (see  FIG. 1 ) is coupled to Havyn, a voice assistant for cybersecurity. The third example includes the following steps: 
     1. Malicious activity detection system  104  (see  FIG. 1 ) detects a Command Shell executing under a Microsoft® Word process 
     2. Malicious activity detection system  104  (see  FIG. 1 ) detects the Command Shell elevated to SYSTEM level privileges 
     3. Malicious activity detection system  104  (see  FIG. 1 ) detects a Credential Theft 
     4. Malicious activity detection system  104  (see  FIG. 1 ) determines that the theft is malicious based on data in an associated process tree 
     5. Malicious activity detection system  104  (see  FIG. 1 ) sends an alert via Havyn 
     6. Havyn picks up the alert and notifies a human analyst via voice: 
     “I have detected a malicious credential theft on host &lt;hostname&gt;” 
     “I recommend the following remediation actions:” 
     “Contain &lt;hostname&gt;” 
     “Reset the following credentials . . . ” (i.e., indicating not all the credentials, but only the credentials that malicious activity detection system  104  (see  FIG. 1 ) determined were affected) 
     “Initiate a patch push for Microsoft Word and send that to &lt;identification numbers of endpoints affected by the vulnerability&gt;” 
     7. The human analyst vocally approves the remediation actions via Havyn 
     8. Havyn initiates the remediation actions via API calls, except for any remediation action that requires higher approval(s). For a remediation action that requires a higher approval, malicious activity detection system  104  (see  FIG. 1 ) sends a request for approval to an appropriate approver and in response to receiving the appropriate approval, initiates the remediation action via an API call. 
     Computer System 
       FIG. 3  is a block diagram of a computer included in the system of  FIG. 1  and that implements the process of  FIG. 2 , in accordance with embodiments of the present invention. Computer  102  is a computer system that generally includes a central processing unit (CPU)  302 , a memory  304 , an input/output (I/O) interface  306 , and a bus  308 . Further, computer  102  is coupled to I/O devices  310  and a computer data storage unit  312 . CPU  302  performs computation and control functions of computer  102 , including executing instructions included in program code  314  for malicious activity detection system  104  (see  FIG. 1 ) to perform a method of detecting a malicious activity in a computer system, where the instructions are executed by CPU  302  via memory  304 . CPU  302  may include a single processing unit or be distributed across one or more processing units in one or more locations (e.g., on a client and server). 
     Memory  304  includes a known computer readable storage medium, which is described below. In one embodiment, cache memory elements of memory  304  provide temporary storage of at least some program code (e.g., program code  314 ) in order to reduce the number of times code must be retrieved from bulk storage while instructions of the program code are executed. Moreover, similar to CPU  302 , memory  304  may reside at a single physical location, including one or more types of data storage, or be distributed across a plurality of physical systems in various forms. Further, memory  304  can include data distributed across, for example, a local area network (LAN) or a wide area network (WAN). 
     I/O interface  306  includes any system for exchanging information to or from an external source. I/O devices  310  include any known type of external device, including a display, keyboard, etc. Bus  308  provides a communication link between each of the components in computer  102 , and may include any type of transmission link, including electrical, optical, wireless, etc. 
     I/O interface  306  also allows computer  102  to store information (e.g., data or program instructions such as program code  314 ) on and retrieve the information from computer data storage unit  312  or another computer data storage unit (not shown). Computer data storage unit  312  includes a known computer readable storage medium, which is described below. In one embodiment, computer data storage unit  312  is a non-volatile data storage device, such as a magnetic disk drive (i.e., hard disk drive) or an optical disc drive (e.g., a CD-ROM drive which receives a CD-ROM disk). 
     Memory  304  and/or storage unit  312  may store computer program code  314  that includes instructions that are executed by CPU  302  via memory  304  to detect a malicious activity in a computer system. Although  FIG. 3  depicts memory  304  as including program code, the present invention contemplates embodiments in which memory  304  does not include all of code  314  simultaneously, but instead at one time includes only a portion of code  314 . 
     Further, memory  304  may include an operating system (not shown) and may include other systems not shown in  FIG. 3 . 
     As will be appreciated by one skilled in the art, in a first embodiment, the present invention may be a method; in a second embodiment, the present invention may be a system; and in a third embodiment, the present invention may be a computer program product. 
     Any of the components of an embodiment of the present invention can be deployed, managed, serviced, etc. by a service provider that offers to deploy or integrate computing infrastructure with respect to detecting a malicious activity in a computer system. Thus, an embodiment of the present invention discloses a process for supporting computer infrastructure, where the process includes providing at least one support service for at least one of integrating, hosting, maintaining and deploying computer-readable code (e.g., program code  314 ) in a computer system (e.g., computer  102 ) including one or more processors (e.g., CPU  302 ), wherein the processor(s) carry out instructions contained in the code causing the computer system to detect a malicious activity in a computer system. Another embodiment discloses a process for supporting computer infrastructure, where the process includes integrating computer-readable program code into a computer system including a processor. The step of integrating includes storing the program code in a computer-readable storage device of the computer system through use of the processor. The program code, upon being executed by the processor, implements a method of detecting a malicious activity in a computer system. 
     While it is understood that program code  314  for detecting a malicious activity in a computer system may be deployed by manually loading directly in client, server and proxy computers (not shown) via loading a computer readable storage medium (e.g., computer data storage unit  312 ), program code  314  may also be automatically or semi-automatically deployed into computer  102  by sending program code  314  to a central server or a group of central servers. Program code  314  is then downloaded into client computers (e.g., computer  102 ) that will execute program code  314 . Alternatively, program code  314  is sent directly to the client computer via e-mail. Program code  314  is then either detached to a directory on the client computer or loaded into a directory on the client computer by a button on the e-mail that executes a program that detaches program code  314  into a directory. Another alternative is to send program code  314  directly to a directory on the client computer hard drive. In a case in which there are proxy servers, the process selects the proxy server code, determines on which computers to place the proxy servers&#39; code, transmits the proxy server code, and then installs the proxy server code on the proxy computer. Program code  314  is transmitted to the proxy server and then it is stored on the proxy server. 
     Another embodiment of the invention provides a method that performs the process steps on a subscription, advertising and/or fee basis. That is, a service provider can offer to create, maintain, support, etc. a process of detecting a malicious activity in a computer system. In this case, the service provider can create, maintain, support, etc. a computer infrastructure that performs the process steps for one or more customers. In return, the service provider can receive payment from the customer(s) under a subscription and/or fee agreement, and/or the service provider can receive payment from the sale of advertising content to one or more third parties. 
     The present invention may be a system, a method, and/or a computer program product at any possible technical detail level of integration. The computer program product may include a computer readable storage medium (or media) (i.e., memory  304  and computer data storage unit  312 ) having computer readable program instructions  314  thereon for causing a processor (e.g., CPU  302 ) to carry out aspects of the present invention. 
     The computer readable storage medium can be a tangible device that can retain and store instructions (e.g., program code  314 ) for use by an instruction execution device (e.g., computer  102 ). The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire. 
     Computer readable program instructions (e.g., program code  314 ) described herein can be downloaded to respective computing/processing devices (e.g., computer  102 ) from a computer readable storage medium or to an external computer or external storage device (e.g., computer data storage unit  312 ) via a network (not shown), for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, switches, firewalls, switches, gateway computers and/or edge servers. A network adapter card (not shown) or network interface (not shown) in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device. 
     Computer readable program instructions (e.g., program code  314 ) for carrying out operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, configuration data for integrated circuitry, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++, or the like, and procedural programming languages, such as the “C” programming language or similar programming languages. The computer readable program instructions may execute entirely on the user&#39;s computer, partly on the user&#39;s computer, as a stand-alone software package, partly on the user&#39;s computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user&#39;s computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present invention. 
     Aspects of the present invention are described herein with reference to flowchart illustrations (e.g.,  FIG. 2 ) and/or block diagrams (e.g.,  FIG. 1  and  FIG. 3 ) of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions (e.g., program code  314 ). 
     These computer readable program instructions may be provided to a processor (e.g., CPU  302 ) of a general purpose computer, special purpose computer, or other programmable data processing apparatus (e.g., computer  102 ) to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium (e.g., computer data storage unit  312 ) that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks. 
     The computer readable program instructions (e.g., program code  314 ) may also be loaded onto a computer (e.g. computer  102 ), other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions/acts specified in the flowchart and/or block diagram block or blocks. 
     The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the Figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions. 
     While embodiments of the present invention have been described herein for purposes of illustration, many modifications and changes will become apparent to those skilled in the art. Accordingly, the appended claims are intended to encompass all such modifications and changes as fall within the true spirit and scope of this invention.