Decoy FIFO Files for Early Malware Detection and Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for blocking malware, such as ransomware, are ineffective as adversaries can detect and avoid monitoring processes, and existing honeypot solutions only provide detection notifications without blocking the attack.
Innovation Solution
A system and method using decoy files implemented as FIFO pipes that do not return read acknowledgments to malware, effectively trapping and preventing malware from encrypting files by ensuring the read process never completes, thereby providing early detection and prevention of damage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional monitoring processes are used to detect malware, then detection capability is provided, but adversaries can detect and avoid the monitoring processes
Solution Approach 1:
The patent introduces FIFO pipes as intermediary objects that mediate between the malware and the system. These pipes appear to be legitimate file objects but actually trap malware read operations, preventing the malware from detecting monitoring processes while still enabling detection of the malicious activity itself.
Solution Approach 2:
The patent creates decoy file objects (FIFO pipes) that copy the appearance and interface of legitimate files but have different internal behavior. These fake file objects trick malware into attempting read operations that will fail, without exposing the actual monitoring mechanisms.
2Reliability
If honeypot solutions are used to detect malware attacks, then detection notifications are provided, but the attack is not blocked
Solution Approach 1:
The patent applies preliminary anti-action by pre-trapping malware in FIFO pipes before the malware can complete its encryption process. The read operation on the FIFO pipe is designed to never return, which preemptively blocks the malware's ability to read and subsequently encrypt files, while still providing detection notifications.
Solution Approach 2:
The patent extracts the harmful read operation from the malware by redirecting it to FIFO pipes that contain no useful data. This separates the detection function from the actual file system operations, allowing the system to notify of attacks while preventing the malware from accessing real files.
3Loss of time
If decoy files are used to trap malware, then early detection is provided, but system resources may be consumed
Solution Approach 1:
The patent uses FIFO pipes as disposable, lightweight objects that consume minimal system resources. These pipes are simple kernel objects that require little memory and processing power compared to full monitoring processes, enabling early detection without significant resource overhead.
Data Source
AI summary
In an approach to detecting and/or blocking malware attacks using decoys, one or more decoy files are created, files, where the one or more decoy files never return a read acknowledgement when read, thereby crippling at least a portion of a malware. The one or more decoy files are propagated to a system. Responsive to the malware initiating a read process on any of the one or more decoy files, the malware is detected.