Discrete Stateful Malware Detection via Periodic Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional anti-virus and anti-malware solutions are reactive and struggle to cope with the exponential growth in sophisticated malware attacks, often failing to detect silent target attacks that infect fewer machines, and behavioral analysis solutions can be complex and cause system stability and performance issues.
Innovation Solution
A method for discrete stateful behavioral analysis that scans a computing system for malware indications at two distinct times, determines system changes, identifies relationships between these changes and executable objects, and flags suspicious objects as potential malware, using anti-virus and memory forensics modules to create behavioral digests and apply behavioral rules for detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If continuous real-time monitoring is implemented to detect malware proactively, then malware detection capability is improved, but system stability and performance deteriorate
Solution Approach 1:
The patent implements periodic scanning at discrete time points instead of continuous monitoring. The system performs scans at specific intervals (first moment in time, second moment in time) to detect malware while avoiding the overhead and stability issues of continuous real-time monitoring. This periodic approach maintains proactive detection capability while preserving system stability.
2Reliability
If sensors are inserted into operating system and application memory for constant monitoring, then malware detection capability is improved, but system complexity increases
Solution Approach 1:
The patent extracts the monitoring function from the operating system core by using portable executable files that run independently. Instead of inserting sensors into OS memory, the system creates separate monitor applications that observe system behavior externally, reducing complexity and avoiding interference with OS stability.
Solution Approach 2:
The patent introduces behavioral analysis rules as intermediaries between system events and malware detection. These rules act as a mediation layer that translates system behaviors into malware indicators without requiring direct integration into the operating system, thereby simplifying the overall system architecture.
3Device complexity
If traditional anti-virus solutions are used, then system simplicity is maintained, but malware detection capability deteriorates
Solution Approach 1:
The patent changes the detection parameters from static signature matching to dynamic behavioral analysis. By monitoring system behavior changes between discrete time points and evaluating them against behavioral rules, the system achieves sophisticated malware detection while maintaining a relatively simple implementation architecture.
Data Source
AI summary
A method for analyzing a computing system includes the steps of at a first moment in time, scanning the resources of the computing system for indications of malware, at a second moment in time scanning the resources of the computing system for indications of malware and determining the system executable objects loaded on the computing system, determining malware system changes, identifying a relationship between the malware system changes and the system executable objects loaded on the computing system, and identifying as suspected malware the system executable objects loaded on the computing system which have a relationship with the malware system changes. The malware system changes include differences between the results of scanning the resources of the computing system for indications of malware at the second and first moment of time.