Provenance-based threat detection tools and stealthy malware detection

This invention describes a computer system that monitors program activities on a computer or network by collecting data on how processes interact, such as which files they access or other programs they start. It builds a detailed map of these activities, then samples and scores parts of this map to identify normal behavior. By converting these activity paths into numerical data and looking for unusual patterns, the system can detect malicious actions and automatically stop the offending program. Specifically, it gathers data by intercepting operating system calls and trains its anomaly detection using only benign, non-malicious data.