Code Execution Profile Assembly for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security systems are limited in detecting malware due to its evasive techniques and performance concerns, compatibility issues, and operating system limitations, which restrict their detection capabilities.
Innovation Solution
A system and method that assemble an execution profile of code by tracking interface usage to identify unwanted data, determining whether the code is associated with malicious activity by comparing it to known legitimate profiles and analyzing the owner of executable memory for legitimacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security systems use traditional detection techniques, then they can detect some malware, but malware evolves evasive techniques that limit detection capabilities
Solution Approach 1:
Instead of trying to detect malware directly through traditional signature-based methods, the system inverts the approach by monitoring legitimate interface usage patterns and identifying deviations. The execution profile establishes what normal code does, and anything that diverges from this profile is flagged as potential malware, turning the detection problem around from direct identification to anomaly detection
Solution Approach 2:
The system changes the detection parameters from static signatures to dynamic execution profiles that track interface usage over time. By monitoring how code interacts with system interfaces and comparing actual usage against established profiles, the system adapts to detect evolving malware that would evade traditional static detection methods
2Measurement precision
If security systems implement comprehensive monitoring to improve detection, then detection accuracy improves, but performance concerns and compatibility issues arise
Solution Approach 1:
The system extracts only the essential interface usage data needed for detection from the complex code execution environment. By focusing monitoring on specific interface calls and their patterns rather than all code behavior, the system achieves accurate malware detection while minimizing performance overhead and compatibility issues
Solution Approach 2:
The system implements partial monitoring of code execution by focusing on interface usage patterns rather than complete code analysis. This selective approach provides sufficient detection accuracy to identify malware while avoiding the performance penalties of comprehensive code inspection
Data Source
AI summary
A system, method, and computer program product are provided for identifying unwanted data based on an assembled execution profile of code. In use, an execution profile of code is assembled by tracking interface usage of the code. Further, it is determined whether the code is associated with unwanted activity, based on the execution profile.