Cognitive Security Intelligence for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for detecting and preventing malware, particularly ransomware, are limited in effectiveness due to their reliance on pre-defined signatures and struggle with the continuously evolving nature of malware, which employs strong encryption and evasion techniques, making it difficult to detect and prevent malicious activities.
Innovation Solution
A method and system for generating cognitive security intelligence that monitors instructions executed by a processor, determines events and activities, correlates them to identify sequences, and maps these sequences with a topographical threat map to detect malware patterns, allowing for remedial measures to be constructed and executed to prevent malware infections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If pre-defined signatures are used to detect malware, then detection speed is improved, but detection accuracy deteriorates due to malware evolution and evasion techniques
Solution Approach 1:
The system performs preliminary analysis of malware behavior patterns and creates predictive models before actual malware execution. By pre-establishing behavioral baselines and anomaly detection rules, the system can quickly compare real-time malware actions against these pre-defined patterns, achieving both fast detection and high accuracy even against evolving malware variants.
Solution Approach 2:
The detection system dynamically adapts its signature patterns based on learned malware behaviors. Instead of using static pre-defined signatures, the system continuously updates its detection rules based on analyzed malware patterns, allowing it to maintain high detection accuracy against evolving threats while preserving fast detection speeds through automated rule generation.
2Strength
If strong encryption algorithms are used by malware, then malware protection is improved, but security detection difficulty increases
Solution Approach 1:
The system converts the harmful encrypted malware code into beneficial analysis data by monitoring decryption processes. When malware attempts to decrypt or execute encrypted payloads, the system captures these behavioral patterns as detection signatures. The very act of malware using strong encryption becomes a detectable event that reveals its malicious nature without requiring breaking the encryption itself.
Solution Approach 2:
The system introduces an intermediary monitoring layer that observes malware behavior without directly interacting with or decrypting the encrypted payloads. This intermediary layer captures metadata, system calls, and behavioral patterns associated with encryption/decryption operations, enabling detection of strongly encrypted malware through indirect observation of its operational characteristics.
3Reliability
If evasion techniques are used by malware, then malware stealth is improved, but detection capability deteriorates
Solution Approach 1:
The system implements feedback loops where detected evasion techniques are analyzed and used to generate new detection rules. When malware successfully evades initial detection through certain techniques, the system learns from these attempts and adjusts its monitoring strategies. This continuous feedback mechanism ensures that detection capability improves over time while maintaining awareness of sophisticated evasion methods.
Solution Approach 2:
The system shifts detection from traditional signature-based dimensions to behavioral and contextual dimensions. Instead of looking for specific malware code patterns that evaders can hide, the system monitors multi-dimensional behavioral characteristics including system call sequences, resource usage patterns, and temporal activity profiles. This dimensional shift makes evasion significantly more difficult as it requires masking complex behavioral patterns rather than simple code signatures.
4Reliability
If file names are scrambled by ransomware, then malware concealment is improved, but file identification difficulty increases
Solution Approach 1:
The system performs preliminary documentation and hashing of file identifiers before ransomware execution. By capturing file metadata, content hashes, and structural characteristics prior to encryption and name scrambling, the system maintains a reference database that enables identification of encrypted files through their immutable characteristics rather than their modified names.
Solution Approach 2:
The system creates and maintains copies of file identification information in multiple formats and locations. Before ransomware can scramble names, the system has already copied essential identification data including content hashes, parent directory relationships, and file type signatures to secure locations. These copies serve as reliable identifiers even when original file names are modified or obscured.
Data Source
AI summary
This disclosure relates to method and system for generating cognitive security intelligence for detecting and preventing malwares. In one embodiment, the method includes monitoring instructions being executed by a processor of a computing system, determining events triggered and activities performed by the execution of the instructions, correlating the events and the activities to determine a sequence of events and activities, and mapping the sequence of events and activities with a topographical threat map to detect a pattern match corresponding to a malware. The topographical threat map is event and activity behavior map of a number of categories of malwares, and is built based on a cognitive analysis using deep learning which may also be enriched with external knowledge or historic knowledge. The method further includes effecting a remedial measure, upon detecting the pattern match, to prevent the malware by constructing remedial instructions to be executed by the processor.