Automated Whitelist Creation for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Behavior monitoring systems for malware detection often result in significant performance overhead and false positives due to the need for extensive rule matching, which can slow down computers and frustrate users, while manual maintenance of white lists is inefficient and prone to errors.
Innovation Solution
A behavior monitor system that automatically maintains a white list by using a driver module and service module to exempt safe processes from rule matching, based on criteria such as digital signatures, launch location, and network connectivity, allowing for automated addition and removal of processes without human intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavior monitoring systems perform extensive rule matching on all processes, then malware detection capability is improved, but system performance deteriorates
Solution Approach 1:
The system segments processes into two categories: whitelisted processes that are exempt from rule matching and blacklisted processes that require full analysis. This segmentation allows the system to maintain high malware detection capability for suspicious processes while significantly improving overall system performance by avoiding unnecessary rule matching on safe processes.
Solution Approach 2:
The patent extracts safe processes from the general population and places them in a whitelist, removing them from the rule matching pipeline. This extraction eliminates the performance overhead associated with analyzing benign processes while preserving the ability to detect malware through continued monitoring of non-whitelisted processes.
2Reliability
If manual maintenance of white lists is performed, then false positives can be reduced, but operational complexity and maintenance burden increase
Solution Approach 1:
The system implements self-service white list maintenance through automated criteria for adding and removing processes. The whitelisting decision service automatically evaluates processes based on predefined characteristics (such as digital signatures, launch locations, and network behavior) without requiring manual intervention, thereby maintaining low false positive rates while eliminating the maintenance burden.
Solution Approach 2:
The system changes the parameters for white list maintenance from manual configuration to automated evaluation based on observable process characteristics. By using parameters such as digital signature validity, launch location, and network connectivity, the system achieves reliable false positive reduction without operational complexity.
3Productivity
If more processes are added to the white list, then performance overhead is reduced, but detection accuracy may deteriorate
Solution Approach 1:
The system applies local quality by differentiating the monitoring intensity based on process characteristics. Whitelisted processes receive minimal monitoring (no rule matching), while non-whitelisted processes receive full monitoring. This localized differentiation optimizes performance overhead for safe processes while maintaining detection accuracy for potentially malicious processes.
Solution Approach 2:
The white list is dynamically maintained with automated addition and removal of processes based on their behavior and characteristics. This dynamic approach ensures that processes are added to the whitelist only when they meet the criteria for safety, preventing performance overhead reduction from compromising detection accuracy, as the list adapts to current system conditions.
Data Source
AI summary
A white list (or exception list) for a behavior monitoring system for detecting unknown malware on a computing device is maintained automatically without human intervention. A white list contains process IDs and other data relating to processes that are determined to be (or very likely be) free of malware. If a process is on this list, the rule matching operations of a conventional behavior monitor are not performed, thereby saving processing resources on the computing device. When a process start up is detected, the behavior monitor performs a series of checks or tests. If the process has all valid digital signatures and is not launched from a removable storage device (such as a USB key) and is not enabled to make any inbound or outbound connections, it is eligible for being on the white list. The white list is also automatically maintained by removing process IDs for processes that have terminated or which attempt to make a new outbound or inbound connection, such as a TCP/UDP connection. Scheduled integrity checks on the white list are also performed by examining the process stack for each process to ensure that there are no abnormal files in the process stack.