Crowdsourced Malicious Process Detection via Risk Score Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious processes consume computer resources, making them unavailable for non-malicious processes, negatively impacting their execution.
Innovation Solution
A system where client devices collect and analyze data on process resource usage and user input to calculate risk scores, with a central device adjusting these scores and populating whitelists and blacklists to identify and manage malicious processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If comprehensive data collection and analysis from multiple client devices is performed to accurately identify malicious processes, then detection precision is improved, but device complexity and processing time increase
Solution Approach 1:
The system segments the malicious process detection task into multiple independent components: client devices collect local process data, a central server aggregates data from multiple clients, and a crowdsourcing platform gathers user feedback. This segmentation allows each component to perform a specific function, improving overall detection precision while distributing system complexity across multiple simple devices rather than requiring one complex centralized system.
Solution Approach 2:
The patent introduces a central server as an intermediary that mediates between client devices and the crowdsourcing platform. The server aggregates process data from multiple clients, calculates risk scores based on collected information, and coordinates the crowdsourcing effort. This intermediary simplifies the architecture by providing a centralized coordination point, reducing the complexity that would otherwise exist in direct peer-to-peer communication between all devices.
2Measurement precision
If additional processing and analysis are performed on identified malicious processes, then detection precision is improved, but loss of time and processing resources increase
Solution Approach 1:
The system performs preliminary actions by continuously collecting process data from multiple client devices and calculating initial risk scores before full malicious process identification is required. User feedback and resource allocation data are gathered in advance, allowing the system to pre-identify suspicious processes. When a detection decision is needed, the system already has pre-processed information ready, reducing the time required for final analysis while maintaining high detection precision.
Solution Approach 2:
The patent applies partial action by performing additional processing only on processes that exceed a certain risk threshold, rather than analyzing all processes equally. The system calculates risk scores for all processes but conducts intensive additional processing (such as code analysis or sandbox execution) only on those identified as potentially malicious. This selective approach maintains high detection precision for malicious processes while minimizing the time and resources spent on benign processes.
3Reliability
If user input is collected from multiple client devices to determine process safety, then reliability is improved, but device complexity and coordination requirements increase
Solution Approach 1:
The patent makes the client devices universal by enabling them to perform multiple functions: collecting local process data, gathering user feedback, transmitting information to the server, and receiving security policies. Each device serves as both a data source and a participant in the crowdsourcing platform, eliminating the need for separate specialized components. This multi-functionality improves reliability through diverse data collection while reducing overall system complexity by using existing devices for multiple purposes.
Solution Approach 2:
The system implements self-service by allowing each client device to autonomously collect its own process data and user feedback without requiring manual configuration or intervention. Devices automatically monitor their local processes, prompt users for safety assessments, and transmit this information to the central server. This automated self-service approach improves reliability through consistent data collection across multiple devices while minimizing the coordination complexity that would arise from manual setup and management.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for categorizing a process using crowdsourcing are described. The methods include the action of receiving data indicating resources allocated upon execution of each of one or more processes. The methods further include the action of receiving data indicating a configuration of the client device. The methods further include receiving data indicating a user selection whether to execute each of the one or more processes. The methods further include the action of determining a risk score that reflects a likelihood that the process is a malicious process. The methods further include the action of identifying a particular process. The methods further include the action of performing additional processing on the particular process. The methods further include the action of determining an updated risk score for the particular process.