Behavioral Malware Detection via Process Feature Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods rely on static signatures, which become large and cumbersome, require significant processing power, and are vulnerable to zero-day attacks, as well as hardware issues related to network connectivity for updates.
Innovation Solution
A method and system that classify processes into categories based on collected features using classification rules and weighted threat scores, comparing these scores to thresholds to determine if a process is malicious, without relying on signature databases.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based malware detection is used, then detection accuracy for known malware is improved, but signature database size and processing power requirements increase
Solution Approach 1:
The patent replaces the mechanical signature-matching system with a behavioral analysis system that monitors process characteristics, API calls, and system interactions. This substitution eliminates the need for large signature databases while maintaining detection effectiveness through dynamic behavior profiling.
Solution Approach 2:
The patent changes the detection parameters from static signature hashes to dynamic behavioral parameters such as process creation patterns, memory access patterns, and API call sequences. This parameter transformation allows detection without requiring extensive signature databases.
2Measurement precision
If signature-based malware detection is used, then detection capability is improved, but system vulnerability to zero-day attacks increases
Solution Approach 1:
The patent implements dynamic behavioral monitoring that adapts to new malware patterns in real-time. Instead of relying on static signatures that must be updated manually, the system continuously learns and adjusts its detection criteria based on observed process behaviors, making it inherently resistant to zero-day attacks.
Solution Approach 2:
The patent performs preliminary behavioral analysis on processes before they can execute malicious actions. By monitoring and analyzing process behavior patterns in advance, the system can detect and prevent zero-day attacks before they cause harm, without needing prior knowledge of specific malware signatures.
3Reliability
If behavior-based malware detection is used, then resilience to zero-day attacks is improved, but processing power requirements increase
Solution Approach 1:
The patent applies partial monitoring by focusing on specific high-value behavioral indicators rather than analyzing every aspect of process execution. This selective approach maintains strong zero-day detection capability while reducing the overall processing burden compared to comprehensive behavior analysis.
Solution Approach 2:
The patent implements self-service through automated behavioral baseline creation and anomaly detection algorithms that learn from historical data without requiring extensive manual configuration or analysis. The system serves itself by automatically adapting to new threats, reducing the need for high processing power dedicated to manual threat analysis.
Data Source
AI summary
Systems and methods for detecting malicious processes in a non-signature based manner are disclosed. The system and method may include gathering features of processes running on an electronic device, applying a set of rules to the features, and applying a statistical analysis to the results of the rules application to determine whether a process should be classified into one or more of a plurality of process categories.