Cloud Reputation Malware Detection via Network Connection Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Server-side polymorphism in malware creates challenges for antivirus techniques, as malware servers generate different binary permutations that anti-virus software may not recognize, leading to difficulties in detection and prevention of malicious activities.
Innovation Solution
A method and system that utilize cloud scanning and web reputation to identify open network connections, associate executable objects with these connections, determine the address of connected network destinations, and evaluate their reputation to detect malware, thereby protecting electronic devices from malicious communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus software uses traditional signature-based detection, then it can identify known malware, but it fails to detect server-side polymorphic malware that generates different binary permutations
Solution Approach 1:
The patent performs preliminary actions by monitoring network connections before malware can complete its malicious activities. The system proactively identifies and blocks connections to known malicious network destinations, preventing malware from communicating with command-and-control servers or downloading additional malicious payloads, rather than waiting for signature-based detection after the fact.
Solution Approach 2:
The patent introduces an intermediary approach by using network destination reputation services as a mediator between the antivirus software and malware. Instead of directly analyzing malware binaries, the system monitors and evaluates the reputation of network destinations that malware attempts to contact, using this intermediary information to detect and block malicious activities.
2Reliability
If the system monitors all network connections to detect malware, then detection capability improves, but system performance and resource consumption increase
Solution Approach 1:
The patent extracts only the critical information needed for malware detection by focusing specifically on network connection destinations rather than monitoring all aspects of system activity. The system extracts the network destination address from each connection and evaluates only this specific parameter against reputation databases, avoiding the overhead of comprehensive system monitoring.
Solution Approach 2:
The patent implements a universal reputation evaluation mechanism that serves multiple detection purposes simultaneously. The same network reputation service evaluates connections for various types of malware including downloaders, spyware, password stealers, and botnet communications, making the system multi-functional without requiring separate detection mechanisms for each malware type.
Data Source
AI summary
A method for detecting malware includes the steps of identifying a one or more open network connections of an electronic device, associating one or more executable objects on the electronic device with the one or more open network connections of the electronic device, determining the address of a first network destination that is connected to the open network connections of the electronic device, receiving an evaluation of the first network destination, and identifying one or more of the executable objects as malware executable objects. The evaluation includes an indication that the first network destination is associated with malware. The malware executable objects includes the executable objects that are associated with the open network connections that are connected to the first network destination.