Covert Malware Detection via Decoy Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional crimeware detection techniques, such as signature-based and anomaly-based methods, are ineffective in detecting covert malware due to high false positives and negatives, and are vulnerable to evasion by malware, which allows significant amounts of crimeware to operate undetected.
Innovation Solution
The use of tamper-resistant injection of believable decoys, where decoy information is injected into a computing environment to lure and deceive covert malware, forcing it to reveal its presence by simulating user activity and verifying state changes, thereby detecting and tracking unauthorized activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection techniques are used, then known malware can be detected, but unknown malware variants cannot be detected due to the large number of possible variants
Solution Approach 1:
The system performs preliminary actions by injecting decoy credentials and simulated user activity into the computing environment before malware can execute its malicious payload. This allows the system to observe and detect malware behavior in advance, capturing evidence of credential stealing attempts before they can harm the actual system.
Solution Approach 2:
The system introduces an intermediary layer consisting of decoy credentials and simulated user activity that acts as a mediator between the detection system and the malware. This intermediary allows the system to study malware behavior indirectly by observing how malware interacts with the decoys, without exposing the actual system to direct malware attacks.
2Measurement precision
If anomaly-based detection techniques are used, then deviations from baseline behavior can be detected, but false positives and false negatives increase
Solution Approach 1:
The system applies preliminary anti-action by preemptively injecting decoy credentials that are designed to trigger malware behavior. This allows the system to detect malware by observing its interaction with the decoys, rather than relying on anomaly detection that may produce false positives or negatives.
3Measurement precision
If host-based antivirus software is used, then malware can be detected from within the host, but the software becomes vulnerable to evasion and subversion by malware
Solution Approach 1:
The system inverts the traditional detection approach by moving from host-based detection to external detection. Instead of running antivirus software within the host that malware can subvert, the system injects decoys from outside the host and observes malware behavior externally, making it difficult for malware to evade or subvert the detection mechanism.
Solution Approach 2:
The system introduces an intermediary layer of decoy credentials and simulated user activity that acts as a mediator between the external detection system and the malware. This intermediary allows the system to study malware behavior indirectly by observing how malware interacts with the decoys, without exposing the actual system to direct malware attacks.
Data Source
AI summary
Methods, systems, and media for detecting covert malware are provided. In accordance with some embodiments, a method for detecting covert malware in a computing environment is provided, the method comprising: receiving a first set of user actions; generating a second set of user actions based on the first set of user actions and a model of user activity; conveying the second set of user actions to an application inside the computing environment; determining whether state information of the application matches an expected state after the second set of user actions is conveyed to the application; and determining whether covert malware is present in the computing environment based at least in part on the determination.