Digital Certificate Validation for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems often ignore or fail to analyze files with digital certificates, as they rely on general trust yielded by certificate validation, allowing malicious files to bypass inspection by grafting a digital certificate, which is not properly validated.
Innovation Solution
A communication system that analyzes digital certificates for files to determine if they are improper, using Authenticode validation and network digital certificate validation to identify malformed or improperly grafted certificates, and checks for fingerprints to identify known certificates, thereby classifying files as malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital certificates are used to sign files, then file trustworthiness is improved, but malware can bypass detection by grafting improper certificates
Solution Approach 1:
The patent performs preliminary validation of digital certificates by checking code signing integrity and certificate grafting status before file execution. This preventive approach identifies improperly grafted certificates and blocks malware before it can execute, resolving the contradiction by maintaining certificate-based trust while preventing malware bypass techniques
Solution Approach 2:
The patent introduces an intermediary validation layer between the digital certificate and file execution. This layer checks whether certificates are properly signed and correctly grafted to files, acting as a mediator that preserves the trust mechanism while filtering out maliciously modified certificates
2Measurement precision
If certificate validation is performed, then malware detection capability is improved, but system complexity increases
Solution Approach 1:
The patent segments the certificate validation process into distinct modular checks: code signing validation, certificate grafting detection, and fingerprint matching. Each module performs a specific validation function independently, improving detection precision while managing system complexity through modular design
Solution Approach 2:
The patent implements targeted certificate validation only for files that require execution, rather than validating all files universally. This partial action approach maintains high detection capability for critical operations while reducing overall system complexity by avoiding unnecessary validation overhead
Data Source
AI summary
Particular embodiments described herein provide for an electronic device that can be configured to analyze data related to a digital certificate and assign a reputation to the digital certificate, where the reputation includes an indication if the data is proper. The analysis of the data can include determining if code signing for the digital certificate matches binary code for the digital certificate, if the digital certificate has been grafted to the data by modifying a portable executable file header, or the digital certificate is the same as another trusted digital certificate associated with different data.