API Trust Metric for Malicious Software Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in accurately identifying malicious software based on API usage, often resulting in false positives and reduced computer security.
Innovation Solution
The implementation of a system and method for malicious software detection based on API trust, which involves generating hooks on APIs to intercept calls, evaluating call stack frames to generate a trust metric, and determining potential threats based on security criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If API usage patterns are analyzed to identify malicious software, then detection capability is improved, but false positive rate increases
Solution Approach 1:
The patent segments the detection process into multiple independent evaluation dimensions: call stack analysis, API trust scoring, behavior pattern matching, and contextual validation. Each dimension operates independently to assess different aspects of software legitimacy, allowing the system to cross-validate findings and reduce false positives while maintaining high detection accuracy
Solution Approach 2:
The system dynamically adjusts detection parameters including trust score thresholds, evaluation weights for different call stack frames, and sensitivity levels for various API categories. These parameter changes enable the system to adapt to different threat landscapes and reduce false positives by tuning the detection criteria based on observed software behavior patterns
2Reliability
If comprehensive security evaluation is performed on all software, then security reliability is improved, but processing time increases
Solution Approach 1:
The patent implements preliminary trust scoring during software installation and initial execution, establishing a baseline security assessment before the software performs critical operations. Call stack frames are pre-evaluated and cached for quick reference, allowing the system to make rapid security decisions during runtime without performing comprehensive re-evaluation of all software components
Solution Approach 2:
The system performs partial security evaluations focused only on the specific call stack frames and API calls relevant to the current operation, rather than comprehensively analyzing the entire software binary. This selective approach applies security scrutiny only where needed based on the execution context, reducing overall processing time while maintaining security reliability
3Measurement precision
If detailed call stack analysis is performed to generate trust metrics, then detection precision is improved, but system complexity increases
Solution Approach 1:
The patent introduces intermediary components including a call stack frame parser that standardizes raw stack trace data, a trust score aggregator that synthesizes multiple evaluation criteria into a single metric, and a cache layer that stores pre-computed analysis results. These intermediaries simplify the overall system architecture by breaking down complex analysis tasks into manageable, reusable components with well-defined interfaces
Data Source
AI summary
Examples of the present disclosure describe systems and methods for malicious software detection based on API trust. In an example, a set of software instructions executed by a computing device may call an API. A hook may be generated on the API, such that a threat processor may receive an indication when the API is called. Accordingly, the threat processor may generate a trust metric based on the execution of the set of software instructions, which may be used to determine whether the set of software instructions poses a potential threat. For example, one or more call stack frames may be evaluated to determine whether a return address is preceded by a call instruction, whether the return address is associated with a set of software instructions or memory associated with a set of software instructions, and/or whether the set of software instructions satisfies a variety of security criteria.