# US 11,030,308 B2 · Inter-application dependency analysis for improving computer system threat detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,030,308 B2 - Document ID: US11030308B2 - Status: Granted - Kind: B2 - Application number: 16/006,164 - Filed: 2018-06-12 - Published: 2019-02-14 - Granted: 2021-06-08 - Earliest claimed: 2017-08-09 - Assignees: NEC Corporation - Applicants: NEC Laboratories America, Inc. - Inventors: Ding Li; Kangkook Jee; Zhengzhang Chen; LuAn Tang; Zhichun Li - Web page: https://patentgrep.com/patent/US11030308B2 ## CPC - G06F 21/552: {involving long-term monitoring or reporting} - G06F 9/4881: {Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues} - G06F 16/2455: Query execution - G06F 16/248: Presentation of query results - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method and system are provided for improving threat detection in a computer system by performing an inter-application dependency analysis on events of the computer system. The method includes receiving, by a processor operatively coupled to a memory, a Tracking Description Language (TDL) query including general constraints, a tracking declaration and an output specification, parsing, by the processor, the TDL query using a language parser, executing, by the processor, a tracking analysis based on the parsed TDL query, generating, by the processor, a tracking graph by cleaning a result of the tracking analysis, and outputting, by the processor and via an interface, query results based on the tracking graph. ## Claims ### Claim 1 A system for improving threat detection in a computer system by performing an inter-application dependency analysis on events of the computer system, comprising: a memory device for storing program code; a processor operatively coupled to the memory device and configured to perform the inter-application dependency analysis by executing program code stored on the memory device to: receive a Tracking Description Language (TDL) query for performing a tracking analysis, the TDL query including general constraints for performing the tracking analysis, a tracking declaration specifying at least events of the computer system to be analyzed, and an output specification specifying a location for storing a tracking graph generated by the tracking analysis; parse the TDL query using a language parser; execute the tracking analysis based on the parsed TDL query by implementing a progressive tracking method to generate a result of the tracking analysis by: splitting dependents of a given one of the events of the computer system into a plurality of execution windows with each of the execution windows being defined as a 3-tuple, where begin is a starting time point, finish is an ending time point, and e is an event of interest, wherein the events of the computer system are used as edges in the tracking graph; enumerating all events occurring in each of the execution windows; and prioritizing the plurality of execution windows based on their respective ending time points; generate a tracking graph by cleaning the result of the tracking analysis by removing all nodes that fail to meet constraints of the TDL query; and output, via an interface, query results based on the tracking graph, the query results including at least one of the tracking graph and an optimized version of the tracking graph. ### Claim 2 (depends on 1) The system of claim 1, further comprising program code stored on the memory device to: pause the execution of the tracking analysis; receive an updated TDL query; and resume the execution of the tracking analysis based on the updated TDL query. ### Claim 3 (depends on 1) The system of claim 1, further comprising program code stored on the memory device to execute the tracking analysis by adaptively parallelizing the progressive tracking method using a plurality of worker threads. ### Claim 4 (depends on 3) The system of claim 3, wherein the progressive tracking method is adaptively parallelized in response to a determination that a number of events with a given depth exceeds a threshold. ### Claim 5 (depends on 1) The system of claim 1, further comprising program stored on the memory device to generate the optimized version of the tracking graph by pruning the tracking graph to generate pruned results using one or more filters, and summarizing the pruned results. ### Claim 6 (depends on 5) The system of claim 5, wherein the pruned results are summarized by merging nodes from the pruned results. ### Claim 7 A computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method for improving threat detection in a computer system by performing an inter-application dependency analysis on events of the computer system, the method comprising: receiving a Tracking Description Language (TDL) query for performing a tracking analysis, the TDL query including general constraints for performing the tracking analysis, a tracking declaration specifying at least events of the computer system to be analyzed, and an output specification specifying a location for storing a tracking graph generated by the tracking analysis; parsing the TDL query using a language parser; executing the tracking analysis based on the parsed TDL query, including implementing a progressive tracking method to generate a result of the tracking analysis by: splitting dependents of a given one of the events of the computer system into a plurality of execution windows with each of the execution windows being defined as a 3-tuple, where begin is a starting time point, finish is an ending time point, and e is an event of interest, wherein the events of the computer system are used as edges in the tracking graph; enumerating all events occurring in each of the execution windows; and prioritizing the plurality of execution windows based on their respective ending time points; generating a tracking graph by cleaning the result of the tracking analysis, including removing all nodes that fail to meet constraints of the TDL query; and outputting, via an interface, query results based on the tracking graph, the query results including at least one of the tracking graph and an optimized version of the tracking graph. ### Claim 8 A computer-implemented method for improving threat detection in a computer system by performing an inter-application dependency analysis on events of the computer system, comprising: receiving, by a processor operatively coupled to a memory, a Tracking Description Language (TDL) query for performing a tracking analysis, the TDL query including general constraints for performing the tracking analysis, a tracking declaration specifying at least events of the computer system to be analyzed, and an output specification specifying a location for storing a tracking graph generated by the tracking analysis; parsing, by the processor, the TDL query using a language parser; executing, by the processor, the tracking analysis based on the parsed TDL query, including implementing a progressive tracking method to generate a result of the tracking analysis by: splitting dependents of a given one of the events of the computer system into a plurality of execution windows with each of the execution windows being defined as a 3-tuple