Adaptive Malicious Program Pattern Detection via Silent Teaching Mode
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus systems face a high number of false detections when using patterns of dangerous behavior to detect malicious programs, which can lead to legitimate programs being incorrectly identified as threats.
Innovation Solution
A method is introduced where a pattern of dangerous behavior is launched in a silent mode on a group of computer systems to gather threat detection statistics, and for systems with low false detection rates, the pattern is converted to an active usage mode, with false detections being added as exceptions to reduce false positives by distinguishing between user actions and malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If patterns of dangerous behavior are used to detect malicious programs, then the quality of behavioral detection is improved, but the number of false detections increases substantially
Solution Approach 1:
The system performs preliminary testing of detection patterns in a silent mode before full deployment. During this preliminary phase, patterns are tested on a group of computer systems to gather statistics on false detections, allowing the system to identify and exclude problematic patterns before they are activated for actual threat removal
Solution Approach 2:
The system implements a feedback mechanism where detection results are analyzed and used to adjust pattern sensitivity. False detections are tracked and fed back into the system to refine pattern matching criteria, allowing the system to learn from mistakes and improve detection accuracy over time
Solution Approach 3:
The system applies different detection strictness levels to different patterns based on their false detection rates. Patterns with high false detection rates are applied more selectively or with modified criteria, while patterns with low false detection rates are applied more aggressively, creating a localized quality approach to pattern application
2Productivity
If patterns are applied aggressively to remove threats, then productivity of threat removal is improved, but false removal actions increase
Solution Approach 1:
Before activating threat removal actions, the system performs preliminary verification by checking detected threats against multiple criteria including pattern match confidence levels, historical false detection data, and system-specific exception lists. This preliminary action ensures that only high-confidence threats are removed, preventing false removal actions while maintaining productivity
Solution Approach 2:
The system introduces an intermediary verification layer between detection and removal actions. This intermediary component analyzes detection results, cross-references them with trusted program databases, and applies decision logic to determine whether removal actions should be executed, thereby mediating between aggressive detection and safe removal
Data Source
AI summary
Disclosed are systems and methods for adapting a pattern of dangerous behavior of programs. A teaching module may load into an activity monitor the pattern and establish a first usage mode for it, during which the activity monitor detects threats that correspond to that pattern, but does not perform actions for their removal. Later, in the course of a teaching period, the activity monitor detects threats based on the detection of events from the mentioned pattern. If the events have occurred as a result of user actions, and the events have a recurring nature or are regular in nature, the teaching module adds parameters to the pattern which exclude from subsequent detection those events or similar events. Upon expiration of the teaching period, the teaching module converts the pattern of dangerous behavior of programs to the second usage mode, during which threats are detected using the modified pattern and removed.