Feedback-Driven Malware Detector Using User Input
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods rely on signature-based systems that can incorrectly identify programs and have a vulnerability window between malware release and signature development, leading to delayed protection against new malware.
Innovation Solution
A feedback-driven malware detector that aggregates user feedback to determine whether an application program is malware by monitoring extensibility points and using a blacklist to prevent malicious program installation, allowing users to opt out of unwanted software execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based malware detection is used, then malware identification capability is improved, but response time to new malware is delayed due to vulnerability window
Solution Approach 1:
The system performs preliminary actions by collecting feedback data from multiple users about application behavior before a malware signature is created. User feedback about unwanted software actions is aggregated and analyzed in advance, allowing the system to prepare detection capabilities before traditional signature-based methods can identify the malware.
Solution Approach 2:
The system introduces feedback loops where user interactions with applications are continuously monitored and reported. This feedback mechanism allows the system to learn about malware behavior patterns in real-time from actual user experiences, enabling rapid identification and response to new malware without waiting for signature development.
2Measurement precision
If reverse-engineering malware code is used to create signatures, then detection accuracy is improved, but time to protect networks is increased
Solution Approach 1:
The system enables self-service by automatically collecting, aggregating, and analyzing user feedback data to identify malware patterns. Instead of requiring manual reverse-engineering of malware code, the system uses automated analysis of user-reported data to generate detection capabilities, significantly reducing the time and resources needed for malware response.
Solution Approach 2:
The system creates copies of malware behavior patterns through aggregated user feedback rather than copying the actual malware code itself. By analyzing multiple instances of malware behavior reported by different users, the system reconstructs malware patterns that can be used for detection without needing to examine or reverse-engineer the original malicious code.
3Productivity
If user feedback aggregation is implemented, then response speed to new malware is improved, but system complexity increases
Solution Approach 1:
The system achieves multi-functionality by using a unified feedback collection mechanism that serves multiple purposes: monitoring application behavior, collecting user preferences, identifying malware patterns, and generating detection rules. This universal approach consolidates what would otherwise require separate specialized systems, reducing overall complexity while maintaining high response speed.
Data Source
AI summary
Embodiments of a feedback-driven malware detector are directed to protecting a computer from programs that perform actions that are malicious or not expected by a user. In one embodiment, the feedback-driven malware detector performs a method that initially determines whether the state of an application program scheduled to be added to an extensibility point on a computer is already known. If the state of the object is not already known, the user is informed that an application program is being installed on the computer and that the application program is being added to an extensibility point. Then, input is obtained from the user that assists in determining whether the application program is malware.