Frequency Spectrum Analysis for Malicious Software Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing detection techniques for malicious software processes in electronic computing devices are computationally intensive and struggle to efficiently detect anomalous resource usage and unauthorized access, especially on mobile devices.

Innovation Solution

The method involves monitoring and analyzing the electromagnetic frequency spectrum generated by a computing device when executing software applications, creating a database of reference frequency spectrums for known applications and modes, and comparing real-time frequency spectrums to detect anomalies indicative of malicious activity.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If signature-based detection techniques are used to detect malicious software, then detection accuracy is improved, but computational overhead increases significantly

Engineering Contradiction:
Improvedetection accuracyVSAvoidcomputational overhead
Core Design Contradiction:
Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent replaces the mechanical/computational system of signature-based file scanning with an electromagnetic field-based detection system. Instead of computationally intensive pattern matching in software, the system uses electromagnetic spectrum analysis to detect malicious processes, thereby reducing computational overhead while maintaining detection accuracy.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent introduces electromagnetic spectrum analysis as an intermediary detection mechanism. Rather than directly analyzing software code or network traffic for signatures, the system uses electromagnetic emissions as an intermediate indicator of malicious activity, enabling faster and more energy-efficient detection.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Speed

If real-time monitoring of software processes is implemented, then detection speed is improved, but energy consumption increases

Engineering Contradiction:
Improvedetection speedVSAvoidenergy consumption
Core Design Contradiction:
SpeedVSUse of energy by stationary object

Solution Approach 1:

The patent substitutes continuous computational monitoring with periodic electromagnetic spectrum sampling. This replacement enables real-time detection capability while significantly reducing energy consumption, as electromagnetic measurements require far less processing power than traditional real-time code analysis.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

3Reliability

If comprehensive security scanning is performed on mobile devices, then detection capability is improved, but device performance degradation increases

Engineering Contradiction:
Improvedetection capabilityVSAvoiddevice performance
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The patent replaces resource-intensive file system scanning and memory analysis with lightweight electromagnetic spectrum monitoring. This substitution maintains comprehensive detection capability while minimizing impact on device performance, as the electromagnetic measurements do not interfere with normal device operations.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS20250190564A1Detection of anomalies associated with interfering processes
Publication Date: 2025.06.12 MICROSOFT TECHNOLOGY LICENSING LLC
  • US20250190564A1 patent drawing
  • US20250190564A1 patent drawing
  • US20250190564A1 patent drawing

AI summary

Methods and systems for detecting anomalous software behavior by monitoring frequency spectrums emanating from an electronic device are provided. A method includes storing frequency spectrum profiles for software applications and operational modes on the device. During execution of a software application, the real-time emanating frequency spectrum is measured and compared to the stored spectrum profile for that application and operational mode. Deviations between the real-time and reference spectrums indicate anomalous behavior from unknown software executing. The device determines a deviation exists and performs remedial actions like alerting the user, disconnecting from the network, shutting down, or switching application execution to another device. Frequency profiles are measured for new applications installed and stored to keep the data updated. Monitoring real-time frequency spectrums emanating from a device provides a computationally lightweight technique for detecting malicious software behavior without requiring complex analysis of application code.