Behavioral Engine for Confidential Data Use Pattern Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional antivirus software is ineffective in detecting and mitigating malware that targets confidential information, particularly uncharacterized threats (0-day exploits) and lacks awareness of data containing sensitive information.
Innovation Solution
A client device hosts a behavioral engine that analyzes the behavior of client applications regarding confidential information, assigning a risk rating and taking mitigating actions if the rating exceeds a threshold, including quarantining, blocking access, or notifying administrators.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional antivirus software uses signatures to detect malware, then detection accuracy for known threats is improved, but detection capability for uncharacterized threats (0-day exploits) deteriorates
Solution Approach 1:
The patent performs preliminary actions by collecting and analyzing behavioral data from client applications before malware can cause harm. The system proactively establishes baseline behavior patterns and detects deviations, enabling early identification of 0-day exploits before signatures are available. This preliminary behavioral analysis allows the system to detect threats based on their actions rather than requiring pre-existing knowledge of their code.
2Reliability
If conventional heuristic engines analyze code behavior, then detection of typical malware patterns is improved, but awareness of confidential information handling deteriorates
Solution Approach 1:
The patent segments the analysis into distinct components: one component monitors general code behavior patterns while another specifically tracks confidential information handling. This segmentation allows the system to maintain reliable malware detection through behavioral analysis while simultaneously gaining awareness of how confidential information is being accessed, moved, or exfiltrated, thereby resolving the contradiction between general detection reliability and specific information awareness.
Solution Approach 2:
The system introduces an intermediary layer that sits between the heuristic engine and the confidential information. This intermediary component specifically monitors data flow and information handling operations, providing dedicated oversight of confidential information without interfering with the broader behavioral analysis. This intermediary enables simultaneous achievement of reliable malware detection and confidential information awareness.
3Reliability
If antivirus software waits for signature distribution, then false positive reduction is improved, but response time to new threats deteriorates
Solution Approach 1:
The system performs preliminary behavioral analysis and establishes baseline patterns before signatures are distributed. By proactively monitoring and understanding normal application behavior, the system can immediately identify deviations caused by new threats without waiting for signature updates. This preliminary preparation enables rapid response to 0-day exploits while maintaining low false positive rates through comparison against established baselines.
Solution Approach 2:
The patent implements dynamic behavioral analysis that continuously adapts to new threats without requiring static signature updates. The system dynamically adjusts its monitoring based on observed behavior patterns, enabling real-time detection of novel malware variants. This dynamic approach allows the system to respond immediately to new threats while maintaining reliability through adaptive false positive filtering.
Data Source
AI summary
A client device hosts a behavioral engine. Using the behavioral engine, the client device analyzes behavior of a client application with respect to confidential information. The client device assigns a rating indicative of risk to the client application based on the behavior of the client application. The client device performs an action to mitigate risk of data loss if the rating exceeds a threshold.