Behavioral Software Identification via Dynamic Operation Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security programs are ineffective in identifying malicious software applications due to evasion techniques like polymorphism, as they rely solely on detecting program signatures or attributes, making it difficult to distinguish between legitimate and malicious behavior.
Innovation Solution
A method that monitors software application instances for matching operation sequences, assigns scores based on observed operations, and classifies instances as malicious if the total score exceeds a threshold, allowing for configured actions such as termination or reporting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security programs rely solely on detecting program signatures or attributes, then they can identify known malicious software, but they become ineffective against polymorphic malware that changes its structure
Solution Approach 1:
Instead of analyzing the static structure of malware (signatures, attributes), the patent inverts the approach by monitoring and analyzing the dynamic behavior and operations performed by the software during execution. This behavioral analysis remains consistent even when the malware's structural form changes, making it effective against polymorphic threats.
Solution Approach 2:
The patent transitions from static signature detection to dynamic behavioral monitoring. By observing operations such as file system access, network connections, and registry modifications in real-time, the system adapts to detect malware regardless of its structural variations, capturing the essential malicious behavior patterns.
2Adaptability or versatility
If security programs use behavioral analysis to detect malware, then they can identify polymorphic threats, but they require monitoring multiple operations in sequence increasing complexity
Solution Approach 1:
The patent segments the behavioral analysis into discrete operation types (file system operations, network operations, registry operations, etc.). Each operation type is monitored and scored independently, allowing the complex behavioral analysis to be broken down into manageable, modular components that can be processed systematically.
Solution Approach 2:
The patent introduces a scoring parameter system where each observed operation contributes a weighted score toward a total maliciousness score. This parameter transformation converts complex behavioral data into a simplified metric that can be compared against thresholds, reducing the complexity of decision-making while maintaining detection accuracy.
3Measurement precision
If security programs monitor detailed operation sequences to classify malware, then they achieve accurate classification, but they consume more processing time and resources
Solution Approach 1:
The patent monitors operations until a confidence threshold is reached, rather than requiring complete analysis of all possible operations. Once the cumulative score indicates sufficient confidence in the classification (exceeding a predefined threshold), the analysis can be terminated, reducing unnecessary processing time while maintaining accurate classification.
Solution Approach 2:
The scoring system provides continuous feedback during the monitoring process. As operations are observed and scored, the system continuously evaluates whether the accumulated evidence is sufficient for classification. This feedback mechanism allows early termination when confidence is adequate, optimizing the balance between accuracy and processing time.
Data Source
AI summary
Operations performed by a software application instance executed by a computing device are monitored. A determination is made that a particular operation performed matches an application signature representing a particular software application. In response, a match score is added to a total score for the software application. In response to determining that the total score is greater than or equal to a threshold, the software is classified.