Behavioral Detection Manager for Malicious Code Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus and behavior blocking software fail to detect new malicious code effectively, allowing it to cause damage before detection, as they rely on signature updates and can only intervene once the code is executed, leading to repeated threats from the same malicious code variants.
Innovation Solution
A blocking-scanning manager detects and blocks attempted malicious behavior, generates a signature for identified code, and prevents its execution, allowing for early recognition and prevention of subsequent attempts by comparing code to stored signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavior blocking software detects malicious code only after execution begins, then detection capability is improved, but the window for preventing damage is reduced
Solution Approach 1:
The system performs preliminary actions by generating and storing signatures of malicious code before it can cause damage. When code is first executed, the system captures its behavioral signature and stores it for future recognition, enabling prevention before subsequent executions occur.
Solution Approach 2:
The system implements feedback by continuously monitoring code execution, generating signatures from detected malicious behavior, and using these signatures to block future instances of the same code, creating a closed-loop detection and prevention system.
2Measurement precision
If antivirus scanning software waits for signature updates, then detection accuracy is improved, but response time to new malicious code increases
Solution Approach 1:
The system performs self-service by automatically generating its own detection signatures from observed malicious code behavior. Instead of relying on external signature updates, the system captures and stores signatures locally, enabling immediate recognition and blocking of new malicious code variants without waiting for external updates.
3Reliability
If behavior blocking software allows multiple executions of malicious code, then false positive reduction is improved, but cumulative damage risk increases
Solution Approach 1:
The system generates and stores signatures during the first execution of malicious code, then uses these pre-generated signatures to block subsequent executions. This allows the system to accurately identify malicious code patterns while preventing repeated damage through proactive signature-based blocking.
Data Source
AI summary
A blocking-scanning manager (101) detects (200) attempted malicious behavior of running code (120). In response to detection, the blocking-scanning manager (101) blocks (206) the attempted malicious behavior. The blocking-scanning manager (101) generates (208) a signature to identify the code that attempted the malicious behavior. The blocking-scanning manager (101) detects (506) code identified by the signature. Responsive to detection, the blocking-scanning manager (101) blocks (508) execution of the identified code (122).