Clean Mode Security Software Malware Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security software, such as firewalls and anti-virus products, are difficult for users to set up and use effectively due to high false positive rates and the need for constant updates of blacklists or extensive configuration of whitelists, leading to user frustration and potential exposure to new threats.
Innovation Solution
Implementing a 'clean mode' in security software where all files installed or modified after a specified date are considered potential threats, with options to use a database to track and verify known safe files, and validate files through code signing certificates to reduce false positives and improve user experience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a black list is used to block applications, then ease of operation is improved, but reliability deteriorates due to false positives and inability to block new threats
Solution Approach 1:
The system performs preliminary action by automatically adding newly installed applications to the black list before they can execute. The firewall monitors application installation and proactively adds them to the blocked list, preventing potential malware from running without requiring user intervention or manual updates.
Solution Approach 2:
The system implements self-service by automatically detecting and blocking new applications without user input. The firewall self-updates its black list by monitoring installation events and autonomously adds new applications to the blocked list, eliminating the need for users to manually maintain the black list while maintaining high protection effectiveness.
2Reliability
If a white list is used to allow applications, then reliability is improved, but device complexity increases due to extensive configuration requirements
Solution Approach 1:
The system inverts the traditional white list approach by using a black list that automatically captures all new applications. Instead of manually approving each application, the system assumes all new applications are potentially malicious and blocks them automatically, inverting the burden from user configuration to automated blocking.
Solution Approach 2:
The system extracts the complexity of application evaluation from the user and places it in the automated firewall system. The firewall handles the complex task of monitoring installations and updating the black list, while users simply need to allow blocked applications when they are legitimate, separating the complex security function from user interaction.
3Ease of operation
If security software blocks applications based on black list, then ease of operation is improved, but loss of time increases due to constant updates and false positives
Solution Approach 1:
The system performs preliminary blocking of new applications at installation time, eliminating the need for subsequent manual black list updates. By adding applications to the black list immediately upon installation, the system prevents future security issues without requiring users to spend time on manual maintenance or updates.
Data Source
AI summary
A method of protecting a computer by having security software be set to clean mode where the clean mode acts as if files installed or modified before the clean date are safe and installed or modified after the clean date as potentially harmful.