Attribution-Based Malware Detection System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods lack accuracy as they solely rely on observing software operations without considering the attribution of the executing device and software, leading to false positives from legitimate software or users.
Innovation Solution
An anti-malware system that collects and compares attribution information of both the executing device and software, using databases to determine a risk score, thereby enhancing detection accuracy by considering comprehensive attribution factors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If malware detection is based solely on observed software operations and events, then the detection method is simple to implement, but the detection accuracy is low due to false positives from legitimate software
Solution Approach 1:
The detection system is segmented into multiple independent modules: event observation module, attribution collection module (collecting device attribution, software attribution, and user attribution information), and determination module. Each module performs a specific function, and together they comprehensively evaluate malware risk by combining multiple attribution factors rather than relying on a single detection method.
2Measurement precision
If comprehensive attribution information is collected and analyzed, then malware detection accuracy improves, but the complexity of the detection system increases
Solution Approach 1:
The system performs preliminary actions by pre-collecting and storing attribution information (device attribution, software attribution, user attribution) in databases before malware detection is needed. This preliminary preparation reduces the difficulty of real-time detection, as the system can directly query pre-collected attribution data rather than gathering it during the detection process.
3Measurement precision
If only objective software operation events are used for detection, then the detection process is straightforward, but it cannot distinguish between malicious and legitimate purposes
Solution Approach 1:
The system implements feedback mechanisms by continuously collecting attribution information from multiple sources (device attributes, software metadata, user profiles) and using this feedback to refine malware determination. The determination module evaluates observed events in conjunction with collected attribution feedback to distinguish between malicious and legitimate software operations, reducing false positives.
Data Source
AI summary
An anti-malware device 50 includes: a risk information storage unit 51 in which risk information 510 is stored, in which there are associated a value indicating an attribution of an information processing device 60 for executing software 600, a value indicating an attribution of the software 600, and a value that indicates the degree of risk when the software 600 is executed; a subject attribution collection unit 53 for collecting the value indicating the attribution of the information processing device 60; an object attribution collection unit 54 for collecting the value indicating the attribution of the software 600; and a determination unit 55 for determining that the software 600 is malware when the value indicating the degree of risk obtained by comparing the risk information 510 and the values collected by the subject attribution collection unit 53 and object attribution collection unit 54 satisfies a criterion.