Executable Abnormality Detection Using OS Catalog File Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current fraud detection mechanisms in computer hardware and software fail to accurately and timely identify fraudulent or malicious events due to unique operating system characteristics and requirements.
Innovation Solution
A system and method that leverages an operating system's catalog and unique executable properties to filter out known good files, using metadata and cryptographic hashes to identify and highlight potential abnormalities through an interactive user interface.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current detection mechanisms based on event logs and probes are used, then detection coverage is provided, but detection accuracy and timeliness deteriorate due to inability to account for unique operating system characteristics
Solution Approach 1:
The system performs preliminary actions by building operating system-specific catalogs of known good executables and their properties before detection occurs. These catalogs pre-establish the baseline of legitimate system files, enabling faster and more accurate detection without complex real-time analysis during actual security events.
Solution Approach 2:
The invention changes detection parameters by shifting from generic event log analysis to operating system-specific executable property analysis. The system examines unique properties such as cryptographic hashes, file metadata, and system-specific attributes that vary by operating system, thereby improving detection precision while maintaining manageable complexity through targeted parameter monitoring.
2Reliability
If generic fraud detection methods are applied to all operating systems, then broad detection coverage is achieved, but detection effectiveness deteriorates due to ignoring unique operating system characteristics
Solution Approach 1:
The detection system is segmented into operating system-specific modules, each with its own catalog of known executables and detection rules tailored to that particular OS. This segmentation allows the system to maintain high reliability for each specific operating system while the overall framework remains versatile across multiple platforms through modular design.
Solution Approach 2:
Operating system-specific catalogs serve as intermediaries between the generic detection framework and the unique characteristics of each operating system. These catalogs translate OS-specific properties into a standardized detection format, enabling the system to adapt to different operating systems without sacrificing detection effectiveness for any particular platform.
3Productivity
If all executables are analyzed without filtering, then comprehensive security checking is performed, but processing efficiency deteriorates due to inability to filter known good files
Solution Approach 1:
The system extracts and removes known good executables from the analysis pool by maintaining catalogs of legitimate system files. By taking out these benign files from further scrutiny, the system dramatically improves processing efficiency while maintaining security completeness through the preliminary cataloging step that ensures all known good files are properly identified and excluded.
Solution Approach 2:
The system performs preliminary action by pre-cataloging known good executables and their properties before the actual detection process. This preliminary cataloging enables the system to quickly filter out legitimate files during runtime analysis, improving processing efficiency without compromising security detection completeness since the baseline of known good files is already established.
Data Source
AI summary
The invention relates to computer-implemented systems and methods that perform forensic investigations including detecting system executable abnormalities. An embodiment of the present invention may be applied to various operating systems, such as Windows, Mac, Linux, etc. Operating systems may represent a collection of programs that coordinate the operation of computer hardware and software and provide common services for computer programs. An embodiment of the present invention recognizes that certain files such as OS catalogs identify known good files and may be filtered out. The OS catalog identifies what executables are expected and further supports what type of files should not be part of the install. An embodiment of the present invention also identifies unique executable properties that relate to a specific operating system. These properties may identify operating system specific characteristics that may be used to filter known good executables.