Endpoint File Reputation via Loadpoint Data Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection systems face challenges in efficiently and accurately determining the reputation of files before installation on endpoint devices, often requiring extensive time and computing resources, and may expose devices to security threats by analyzing file behavior post-installation.
Innovation Solution
The system identifies and analyzes loadpoint data entries created by files during boot-up operations, determining their reputation across a group of endpoint devices, and uses this information to assess the reputation of similar files attempting to be installed, thereby preventing malicious files from being installed and reducing the need for content analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional malware detection systems analyze content of files by computing hashes and comparing to known malware, then malware detection accuracy is improved, but extensive time and computing resources are required
Solution Approach 1:
The system performs preliminary analysis of loadpoint data entries during file installation before the file is fully deployed. By examining registry keys and boot-up directives early in the installation process, the system determines file reputation upfront, avoiding the need for extensive post-installation monitoring and reducing both time and computational resources required for complete malware detection
Solution Approach 2:
The system extracts and analyzes specific critical components (loadpoint data entries, registry keys, boot-up directives) from the file installation process separately from the entire file content. This selective extraction focuses computational resources on the most indicative elements of malware behavior rather than analyzing every byte of the file, thereby reducing overall computing requirements while maintaining detection accuracy
2Reliability
If conventional malware detection systems monitor behaviors exhibited by files after installation, then malware detection capability is improved, but the endpoint device is exposed to security threats
Solution Approach 1:
The system applies preliminary anti-action by blocking or preventing the installation of files with malicious loadpoint data entries before they can be executed on the endpoint device. By determining file reputation during the installation process and intercepting potentially malicious files upfront, the system eliminates the need for post-installation behavior monitoring that would otherwise expose the device to security threats
Solution Approach 2:
The system introduces an intermediary analysis layer that examines loadpoint data entries and registry keys during file installation without requiring the file to be fully installed or executed on the endpoint device. This intermediary assessment occurs in a controlled environment during installation, allowing the system to evaluate behavioral indicators without exposing the production endpoint to potential malware execution
3Measurement precision
If the system determines reputation of loadpoint data entries by analyzing files across multiple endpoint devices, then reputation accuracy is improved, but system complexity increases
Solution Approach 1:
The system implements a centralized backend security server that serves multiple endpoint devices with file reputation assessments. This universal server performs the complex cross-device analysis of loadpoint data entries once, then distributes the reputation information to numerous endpoints. The multi-functionality of the backend server handles reputation determination for all connected devices, improving accuracy through aggregated data while avoiding the complexity of implementing distributed analysis on each individual endpoint
Data Source
AI summary
The disclosed computer-implemented method for determining reputations of files may include (i) identifying, on an endpoint device, a loadpoint data entry created by a file installed on the endpoint device that directs an operating system of the endpoint device to execute the file during boot up operations of the endpoint device, (ii) determining a reputation of the loadpoint data entry, (iii) detecting, on an additional endpoint device, an attempt to install a suspicious file with a loadpoint data entry at least partially similar to the loadpoint data entry of the file installed on the endpoint device, (iv) determining a reputation of the suspicious file based on the reputation of the loadpoint data entry of the file installed on the endpoint device, and (v) protecting the additional endpoint device from security threats by performing a security action on the suspicious file based on the reputation of the suspicious file.