Cloud AI Engine for Malware Detection via Static and Dynamic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection techniques are ineffective in identifying zero-day attacks and modified malware, as they rely on static analysis and are vulnerable to anti-emulation tricks, limiting their ability to detect unknown or obfuscated malware.
Innovation Solution
A cloud-based AI engine that collects and analyzes data from multiple computing devices to identify suspicious activity patterns, detect malware, and generate remedial actions, including identifying zero-day attacks and malware authors, by combining static and dynamic analysis without relying on virtual environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If static analysis techniques are used to scan software code and compare with known malware characteristics, then detection speed is improved, but detection accuracy for zero-day attacks and modified malware deteriorates
Solution Approach 1:
The patent combines static analysis and dynamic analysis techniques into a unified malware detection system. Static analysis provides rapid initial screening by scanning code for known malware characteristics, while dynamic analysis executes the software in a monitored virtual environment to observe actual behavior. This merging allows the system to maintain fast detection speeds through static analysis while achieving high accuracy for zero-day and modified malware through dynamic behavioral observation.
2Measurement precision
If dynamic analysis techniques are used to execute suspicious code in a monitored virtual environment, then detection accuracy for unknown malware is improved, but vulnerability to anti-emulation tricks and system complexity worsens
Solution Approach 1:
The patent introduces a virtual machine as an intermediary environment for executing suspicious code. This virtual environment isolates the analysis process from the host system, allowing dynamic observation of malware behavior without direct risk to the actual system. The virtual machine mediates between the suspicious code and the monitoring system, enabling accurate detection of unknown malware while managing complexity through standardized virtualization interfaces.
3Loss of information
If manual investigation processes are used for zero-day attacks, then analysis depth is improved, but response time and productivity deteriorate
Solution Approach 1:
The patent implements automated analysis systems that perform malware investigation without requiring constant human intervention. The system automatically executes suspicious code in virtual environments, monitors behavioral patterns, compares results against known malware characteristics, and generates detection reports. This self-service capability maintains deep analysis quality while dramatically improving response time and productivity by eliminating manual investigation bottlenecks.
4Measurement precision
If security analysts manually investigate malware samples, then detection accuracy for complex threats is improved, but the limitation of analyst quantity and qualification worsens
Solution Approach 1:
The patent replaces manual analyst investigation with automated computational systems. Software agents execute predefined analysis protocols, virtual machines run suspicious code under monitoring, and algorithms compare observed behaviors against malware databases. This substitution maintains high detection accuracy for complex threats by systematically analyzing behavioral patterns while overcoming resource constraints by automating tasks previously requiring human analysts.
Data Source
AI summary
Methods and systems are disclosed herein for detecting malicious software executing on a plurality of computing devices. In an exemplary aspect, a method comprises collecting, from a plurality of agents executing on a respective computing device, analysis data corresponding to executables on the respective computing device, determining a suspicious activity pattern based on the received analysis data, determining that at least one executable on a computing device is malware based on the determined suspicious activity pattern, generating a plurality of remedial actions for protecting respective computing devices of the plurality of agents based on the suspicious activity pattern, and distributing, to the plurality of agents, the plurality of remedial actions to protect the respective computing device from the malware.