Asynchronous Event Processing for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods, such as signature scanning and emulation, are inadequate in detecting new or evolving malware due to their reliance on known signatures and synchronous processing, which can delay system functionality and consume significant resources.
Innovation Solution
An asynchronous processing method for system events that analyzes application behavior using heuristic and signature data, allowing for real-time detection of malicious activities without interrupting system processes, and automatically classifies applications based on behavior patterns to optimize malware threat processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If synchronous analysis is used to detect malware events, then detection accuracy is improved, but system functionality is delayed
Solution Approach 1:
The system segments event processing into two independent pathways: synchronous processing for high-priority security events that require immediate analysis, and asynchronous processing for standard events. This segmentation allows critical security detections to maintain high accuracy while non-critical events are processed without blocking system functionality, resolving the contradiction between detection reliability and system responsiveness.
Solution Approach 2:
An event queue acts as an intermediary buffer between event generation and analysis. Events are placed in the queue for asynchronous processing rather than being handled synchronously, which eliminates blocking delays. The queue mediates between the need for thorough malware detection and the requirement for continuous system operation, allowing analysis to occur without interrupting system functionality.
2Speed
If signature scanning is used to detect known malware, then detection speed is improved, but new or evolving malware is not detected
Solution Approach 1:
The system merges multiple detection approaches: signature-based scanning for known malware patterns, heuristic analysis for suspicious behavior patterns, and anomaly detection for unknown threats. By combining these methods, the system achieves both the speed of signature matching and the adaptability to detect new or evolving malware that lacks known signatures.
Solution Approach 2:
The detection system dynamically adapts its analysis methods based on event characteristics and evolving threat landscapes. Heuristic rules and behavioral thresholds are updated continuously to reflect new malware techniques, allowing the system to maintain high detection speed for known threats while simultaneously adapting to detect previously unseen malware variants.
3Reliability
If emulation is used to analyze malware behavior, then detection accuracy is improved, but processing time increases and resources are consumed
Solution Approach 1:
Instead of fully emulating all malware behavior, the system performs partial analysis by monitoring specific system calls and behavioral patterns that are indicative of malicious activity. This partial action approach maintains high detection accuracy for critical threats while significantly reducing the computational overhead and processing time associated with complete emulation, thereby preserving system productivity.
Solution Approach 2:
The system implements periodic sampling of malware behavior rather than continuous monitoring. By analyzing system calls and events at strategically selected intervals, the system achieves sufficient detection accuracy while reducing resource consumption and improving processing throughput compared to constant emulation monitoring.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and a method for malware detection based on the behavior of applications running on a computer system, including: asynchronous processing of system events for malware threat analyses using application filters; analyzing events using heuristic and signature data; analyzing applications behavior and detecting abnormal behavior of "clean" applications; automatically classifying applications (i.e., detecting new versions) based on behavior analysis; automatically analyzing the reliability of web sites based on behavior triggered by the web site accesses; in enterprise networks, detecting abnormalities in configuration of user computer systems.