Asynchronous Event Filtering for Malware Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional malware detection methods, such as signature scanning and emulation, are inefficient in detecting new or evolving malware due to resource-intensive synchronous processing and delayed system functionality, which allows malicious code to potentially harm the system before detection.

Innovation Solution

An asynchronous processing system that analyzes system events using application filters, comparing behavior against normal activity rules to classify applications as malicious, allowing for real-time detection without interrupting system processes and utilizing heuristic and signature data to update white and black lists.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If synchronous event processing is used for malware detection, then detection accuracy is improved, but system functionality is delayed

Engineering Contradiction:

Improvemalware detection accuracyVSAvoidsystem functionality delay

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent segments the event processing into two independent paths: a synchronous path for critical security events requiring immediate analysis, and an asynchronous path for less critical events that can be processed later. This allows the system to maintain detection accuracy for important events while avoiding delays in non-critical operations, resolving the contradiction between detection precision and time loss.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system dynamically adjusts processing mode based on event characteristics and system state. The event filter analyzes each event and determines whether synchronous or asynchronous processing is appropriate, allowing the system to optimize between detection accuracy and functionality delay in real-time based on the specific event being processed.

Inventive Principle:

Principle #15Dynamics

2Reliability

If synchronous analysis is performed on suspicious events, then detection reliability is improved, but process execution is delayed

Engineering Contradiction:

Improvedetection reliabilityVSAvoidprocess execution speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent divides event processing into reliable synchronous analysis for high-priority events and faster asynchronous processing for lower-priority events. This segmentation allows the system to maintain detection reliability where needed while improving overall process execution speed by not blocking all operations on synchronous analysis.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The event filter acts as an intermediary that triages events before they reach the full analysis system. It prioritizes events and determines processing mode, allowing critical events to receive synchronous analysis for reliability while less critical events proceed asynchronously, thus balancing detection reliability with process execution speed.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If conventional filtering methods are used, then system security is maintained, but processing time increases

Engineering Contradiction:

Improvesystem securityVSAvoidprocessing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The dynamic event filter adjusts its filtering intensity and processing mode based on system state and event characteristics. During normal operation, it uses lighter filtering for speed, but switches to more intensive synchronous analysis when security threats are detected, thus maintaining system security while minimizing processing time under normal conditions.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system uses periodic sampling and batch processing for less critical event filtering, rather than continuously processing every event synchronously. This allows the system to maintain security through regular checks while reducing processing time by not immediately analyzing every event in real-time.

Inventive Principle:

Principle #19Periodic action

Data Source

PatentUS8935791B2Asynchronous filtering and processing of events for malware detection

Publication Date: 2015.01.13 AO KASPERSKY LAB

AI summary

A method for asynchronous processing of system calls, including detecting a system call on a computer system; filtering the system call to determine when the system call call matches a filter parameter; making a copy of the system call and asynchronously asynchronously processing the system call copy, if the system call does not pass through at through at least one filter, and the filter parameter does not match the system call; placing placing the system call into a queue; releasing the system call after an anti-virus (AV) (AV) check of the system call copy and terminating an object that caused the system call call when the AV check reveals that the system call is malicious; and for an object associated with the system call that has behavior differences compared to a previous known known non-malicious version of the object but also similarities to the previous known non-known non-malicious object, classifying the object as non-malicious.