Antivirus Trust-Based Event Monitoring for System Load Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus systems face inefficiencies in detecting malicious code due to resource-intensive monitoring and analysis, which can cause system freezing and delays, especially when malicious code infiltrates the address space of trusted processes, making it difficult to distinguish between legitimate and suspicious actions.
Innovation Solution
A method that dynamically assigns a trust status to objects within a computer system, allowing only essential or critical events to be monitored based on the trust level, thereby reducing the need for comprehensive malware analysis and minimizing resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive monitoring and analysis of all processes is performed to detect malicious code, then detection reliability is improved, but system performance deteriorates causing freezing and delays
Solution Approach 1:
The patent applies local quality by differentiating monitoring intensity based on process trust status. Trusted processes receive minimal monitoring (only essential events), while untrusted processes undergo comprehensive critical event monitoring. This localized approach to security monitoring resolves the contradiction by concentrating resources on high-risk areas while maintaining system-wide detection capability.
Solution Approach 2:
The patent segments the monitoring process into two distinct paths: essential event monitoring for all processes and critical event monitoring for untrusted processes. This segmentation allows the system to maintain reliable detection across all processes while optimizing performance by applying intensive monitoring only where necessary.
2Measurement precision
If comprehensive monitoring of all processes is performed to detect malicious code, then detection precision is improved, but resource consumption increases
Solution Approach 1:
The patent implements local quality by applying different levels of analysis precision to different processes. Trusted processes undergo minimal analysis (essential events only), while untrusted processes receive full precision analysis (critical events). This resolves the contradiction by maintaining high detection precision where needed while reducing overall resource consumption.
Solution Approach 2:
The patent applies partial action by performing complete critical event analysis only on untrusted processes rather than all processes. This partial application of intensive monitoring maintains detection precision for suspicious code while significantly reducing computational resource consumption compared to universal comprehensive monitoring.
3Reliability
If critical events are monitored for all processes, then malicious code detection capability is improved, but system responsiveness deteriorates
Solution Approach 1:
The patent applies local quality by restricting critical event monitoring to untrusted processes only, while trusted processes experience minimal monitoring overhead. This localized approach maintains strong detection capability for malicious code while preserving system responsiveness by avoiding unnecessary monitoring of legitimate processes.
Solution Approach 2:
The patent implements partial action by applying comprehensive critical event monitoring only to the subset of untrusted processes rather than all processes. This partial monitoring strategy maintains detection capability for suspicious code while minimizing the time loss and responsiveness impact on overall system performance.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An initial trust status is assigned to a first object, the trust status representing one of either a relatively higher trust level or a relatively lower trust level. Based on the trust status, the first object is associated with an event type to be monitored, where the event type is selected from among: essential events, occurrence of which is informative as to trust status evaluating for an object, and critical events, including the essential events, and additional events, occurrence of which is informative as to execution of suspicious code. Occurrences of events relating to the first object are monitored. In response to the first object being assigned the relatively higher trust level, only the essential events are monitored. In response to the first object being assigned the relatively lower trust level, the critical events are monitored. A need for performing malware analysis is determined based on the trust status of the first object and the event type. In response to determination of the need for performing the malware analysis, the malware analysis for the first object is either performed, or not.