Behavioral Vector Encoding for Malicious Program Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malicious program detection methods rely on signature-based approaches that are inefficient for detecting new variants, as they require updating detection programs with new character strings, leading to delayed detection and increased power consumption, especially in mobile devices, and lack effective solutions for vulnerabilities beyond signature matching.
Innovation Solution
A method and apparatus that model the behavior of computer programs by collecting system use information, extracting behavior signatures, and encoding them into behavior vectors to differentiate between normal and malicious programs, allowing for more accurate detection without requiring updates for new variants and reducing power consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection is used to identify malicious programs, then detection accuracy for known malware is improved, but detection speed deteriorates due to increasing numbers of character strings to check
Solution Approach 1:
The patent extracts only the essential behavioral characteristics of malicious programs (such as file modification patterns, registry changes, process injection behaviors) rather than checking all possible signature variations. This extraction approach reduces the detection space from numerous character string variants to a small set of core behavioral indicators, thereby improving detection speed while maintaining accuracy.
Solution Approach 2:
The detection system is segmented into multiple independent analysis modules: behavior collection module, behavior analysis module, and detection module. Each module handles specific aspects of malware detection, allowing parallel processing of different behavioral characteristics. This segmentation enables the system to check multiple behavioral indicators simultaneously, significantly improving detection speed without compromising accuracy.
2Adaptability or versatility
If multiple character strings are extracted to detect variants of malicious programs, then detection coverage is improved, but power consumption increases due to extensive string extraction and verification operations
Solution Approach 1:
The patent changes the detection parameter from character string matching to behavioral parameter monitoring. Instead of extracting and comparing numerous text signatures, the system monitors executable behaviors (file operations, registry modifications, process actions) which remain consistent across malware variants. This parameter transformation reduces computational intensity and power consumption while maintaining broad detection coverage.
Solution Approach 2:
The behavior analysis module serves multiple detection purposes simultaneously: it detects known malware, identifies new variants, and profiles malicious behavior patterns. This universal behavioral analysis approach replaces the need for separate signature databases for different malware types, reducing overall system resource consumption and power usage while maintaining comprehensive detection coverage.
3Reliability
If signature databases are continuously updated to detect new malicious programs, then detection reliability is improved, but detection time increases due to program re-development and information addition delays
Solution Approach 1:
The system performs preliminary behavioral analysis on suspicious programs before they can execute malicious actions. By monitoring and analyzing program behaviors in advance (file access patterns, registry queries, process creation attempts), the system can identify malicious intent early in the execution cycle, eliminating the need for time-consuming signature database updates and enabling immediate detection of new threats.
Solution Approach 2:
The behavior analysis system implements continuous feedback loops where detected behavioral patterns are immediately fed back into the detection engine. When new malicious behaviors are identified, the system automatically updates its detection rules in real-time without requiring external signature database updates. This feedback mechanism ensures high detection reliability while minimizing detection time delays.
Data Source
AI summary
A method and apparatus for modeling a behavior of a computer program that is executed in a computer system is described. The method and apparatus for modeling a behavior of a computer program may be used to detect a malicious program based on the behavior of the computer program. A method includes collecting system use information about resources of the computer system the computer program uses; extracting a behavior signature of the computer program from the collected system use information; and encoding the extracted behavior signature to generate a behavior vector. As a result, behaviors of a particular computer program may be modeled to enable a malicious program detection program and to determine whether the computer program is either normal or malicious.