Autorun File Identification via Malicious Code Association
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security systems are ineffective in identifying and removing unwanted autorun files, as they often fail to detect obfuscated malware and can result in false positives due to common file names, leading to residual errors and incomplete removal.
Innovation Solution
A system and method that identifies files used to automatically launch content by detecting unwanted code, determining if an associated identifier is present, and comparing against local and remote lists of predetermined unwanted codes, ensuring accurate identification and potential deletion of such files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional string or hash based signature detection techniques are used to identify autorun files, then detection speed is improved, but detection accuracy deteriorates due to obfuscation and false positives
Solution Approach 1:
The patent segments the detection process into multiple stages: initial fast scanning using signature detection, followed by behavioral analysis and verification. This allows the system to quickly filter obvious threats while applying more sophisticated analysis only when needed, maintaining both speed and accuracy.
Solution Approach 2:
The patent introduces an intermediary verification layer that acts as a mediator between fast signature-based detection and final threat confirmation. This intermediary performs additional checks including behavioral analysis and cross-referencing with multiple detection methods to verify true positives while filtering false positives.
2Productivity
If traditional security systems remove only the launched content but not the autorun file, then removal speed is improved, but system reliability deteriorates due to residual errors
Solution Approach 1:
The patent performs preliminary identification and marking of both the autorun file and the launched content together during the detection phase. This preliminary action ensures that when removal occurs, both components are already identified and can be removed simultaneously or in the correct sequence, preventing residual errors.
Solution Approach 2:
The patent merges the identification and removal processes for both the autorun file and the launched content into a unified security response. Instead of separate operations, the system treats them as a coupled threat unit, ensuring complete elimination of the malicious payload and its delivery mechanism.
3Stability of the object's composition
If common file names are used for malware to evade detection, then malware persistence is improved, but false positive detection increases
Solution Approach 1:
The patent employs dynamic analysis that observes file behavior rather than relying solely on static characteristics like file names. The system monitors what the file does (attempts to execute, modify system files, establish persistence) rather than what it is called, allowing legitimate files with common names to pass while catching malware that uses deceptive naming.
Solution Approach 2:
The patent changes the detection parameters from static file attributes (name, hash) to dynamic behavioral parameters (execution attempts, system modifications, process creation). This parameter shift allows the system to ignore deceptive file names and focus on actual malicious behavior, reducing false positives while maintaining detection of persistent malware.
4Quantity of substance
If autorun files with obfuscated content are scanned using traditional methods, then scanning coverage is improved, but detection accuracy deteriorates
Solution Approach 1:
The patent adds another dimension to the scanning process by incorporating behavioral analysis and execution monitoring alongside traditional content scanning. Instead of relying solely on examining file contents in one dimension, the system observes the file's behavior in operation, creating a multi-dimensional detection approach that penetrates obfuscation.
Solution Approach 2:
The patent substitutes mechanical signature-matching systems with behavioral analysis systems that observe actual file execution and system interactions. This replacement allows detection of obfuscated content by focusing on what the file attempts to do rather than what it contains, maintaining scanning coverage while improving accuracy.
Data Source
AI summary
A system, method, and computer program product are provided for identifying a file utilized to automatically launch content as unwanted. In one embodiment, a file is identified in response to a detection of unwanted code, the file utilized to automatically launch content. Additionally, it is determined whether an identifier associated with the unwanted code is included in the file. Further, the file is identified as unwanted based on the determination.