Dynamic Quarantining for Malware Detection via Reputation Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware solutions struggle to detect new or morphed malware, particularly in zero-day attacks, due to reliance on signature-based methods and limited access to real-time threat intelligence, leading to potential false positives and false negatives.
Innovation Solution
A dynamic quarantining system that employs a monitor to intercept and evaluate data for malware, using a reputation server to provide a likelihood score based on real-time analysis from various sources, allowing or blocking data based on thresholds, and repeatedly reevaluating unknown or potentially malicious data to determine its safety.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based anti-malware methods are used, then detection of known malware is improved, but detection of new or morphed malware (zero-day attacks) deteriorates
Solution Approach 1:
The system performs preliminary actions by proactively querying the reputation server for threat intelligence data before evaluating software. This advance preparation enables the system to have detection capabilities ready for new malware variants by continuously updating its knowledge base through periodic reputation queries, rather than waiting to encounter and analyze the malware first.
Solution Approach 2:
The patent introduces an intermediary reputation server that acts as a mediator between the local anti-malware system and threat intelligence sources. This intermediary provides real-time reputation data and threat information that enhances the system's ability to detect new and morphed malware without relying solely on local signature databases, thereby bridging the gap between known and unknown threat detection.
2Reliability
If dynamic quarantining with repeated reevaluation is implemented, then malware detection reliability is improved, but system processing time increases
Solution Approach 1:
The system implements periodic action through scheduled reputation queries and time-delayed reevaluation of quarantined data. Instead of continuous monitoring that would consume excessive resources, the system performs evaluations at specific intervals, balancing reliability improvement with acceptable processing time requirements. This periodic approach allows the system to reassess quarantined items without creating constant overhead.
Solution Approach 2:
The dynamic quarantining system provides self-service functionality by automatically reevaluating quarantined data after time delays without requiring manual intervention. The system manages its own security assessments by periodically querying reputation information and making autonomous decisions about releasing or maintaining quarantine status, thereby improving reliability while minimizing the time burden on users and systems.
3Measurement precision
If real-time reputation querying is performed, then threat intelligence accuracy is improved, but system resource consumption increases
Solution Approach 1:
The system employs periodic action by implementing scheduled reputation queries rather than continuous real-time querying. This approach maintains threat intelligence accuracy by regularly updating reputation data at defined intervals, while significantly reducing system resource consumption compared to constant monitoring. The periodic nature allows the system to balance accuracy requirements with resource availability.
Solution Approach 2:
The patent applies partial action by querying reputation information selectively rather than for all data evaluations. The system performs reputation queries based on specific conditions and risk assessments, obtaining sufficient threat intelligence accuracy for critical cases while avoiding unnecessary resource consumption for low-risk scenarios. This partial approach provides adequate protection without the full resource overhead of universal real-time querying.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method includes detecting a portion of data on an electronic device, determining a first representation of the malware status of the data, quarantining the data for a period of time, estimating whether the data is associated with malware by comparing the first and second representation, and, based on the estimation, releasing the data from quarantine. The first representation indicates that the malware status of the data is not certain to be safe and the malware status of the data is not certain to be malicious.