Canary File Scoring for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-malware solutions rely on virus signatures and extensive training, which are often evaded by malware and lack effective detection and remediation mechanisms, especially when bundled with general-purpose enterprise applications.
Innovation Solution
A computer-implemented method that monitors process actions on a system, selectively presents canary files to untrusted processes, scores processes based on malicious actions, and automatically terminates processes with a high malice score, while hiding canary files from trusted processes and backing up files accessed with change privileges.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-malware solutions use virus signatures and extensive training, then they can detect known malware, but malware regularly evades these solutions
Solution Approach 1:
The patent implements dynamic behavior monitoring that tracks process actions in real-time rather than relying on static signatures. The system dynamically scores processes based on observed behavior patterns, allowing it to adapt to new malware variants that evade traditional signature-based detection.
Solution Approach 2:
The system continuously monitors process behavior and uses feedback from observed actions to adjust malice scores. This feedback loop allows the anti-malware solution to learn from actual malware behavior patterns and improve its detection accuracy over time, countering evasion techniques.
2Measurement precision
If anti-malware solutions use local emulation sandboxes, then they can analyze malware behavior, but they are prone to detection and evasion by malware
Solution Approach 1:
The patent applies self-service by having the monitored processes themselves generate the data needed for analysis. Instead of external sandboxes analyzing malware, the system monitors the processes' own actions, file accesses, and system calls, making the processes themselves the source of detection data and eliminating sandbox evasion vectors.
Solution Approach 2:
The system introduces an intermediary layer of behavior monitoring that sits between the process and the detection mechanism. This intermediary collects and analyzes process actions without requiring the process to execute in a sandboxed environment, thereby avoiding sandbox detection and evasion issues.
3Adaptability or versatility
If anti-malware solutions are bundled with general-purpose enterprise applications, then they are available as part of the suite, but they cannot be purchased separately
Solution Approach 1:
The patent describes a modular anti-malware component that can be segmented from general-purpose enterprise applications. The behavior monitoring and scoring functionality is designed as a separate, independently licensable module that can be deployed standalone or integrated with other applications, providing licensing flexibility.
Data Source
AI summary
Malware prevention and remediation is provided by monitoring actions performed by processes and maintaining indications of which processes are trusted; selectively presenting canary files to these processes, which includes presenting the canary files to processes not indicated as being trusted and hiding the canary files from processes indicated as being trusted, and where the monitoring includes monitoring for access of canary files with change privileges; scoring each of the processes based on the actions performed, including any access of canary files with change privileges, which scoring produces a malice score for each process; and automatically terminating any process for which its malice score indicates at least a threshold level of malice in the execution of the process.