Granular Reputation Engine for Executable Action Assessment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer security systems face challenges in accurately assessing and managing the vulnerabilities of executable objects, often resulting in false positives and inadequate protection against potentially unwanted content (PUC) such as malware and grayware, which can exhibit both legitimate and malicious behaviors.
Innovation Solution
A vulnerability assessment engine that intercepts actions associated with executable objects, assigns context-specific reputations, and intervenes only when suspicious behavior is detected, using a granular reputation system to allow, block, or seek user input, thereby differentiating between whitelisted, graylisted, and blacklisted actions, and integrates with a global threat intelligence database for further analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus scanning is used to detect malicious executable objects, then security protection is provided, but false positives occur and legitimate applications are incorrectly identified as malicious
Solution Approach 1:
The patent segments the reputation assessment into multiple granular components: file reputation, publisher reputation, action reputation, and contextual reputation factors. Instead of treating each executable object as a single entity, the system evaluates multiple independent reputation dimensions separately and combines them to form a comprehensive risk assessment, thereby reducing false positives while maintaining security protection.
Solution Approach 2:
The system changes the assessment parameters from binary (malicious/legitimate) to multi-dimensional reputation scores. It introduces dynamic parameters such as publisher verification status, action type reputation, contextual behavior patterns, and historical incident data. These parameter changes enable more precise differentiation between genuinely malicious files and legitimate applications with suspicious but acceptable behaviors.
2Reliability
If intervention is triggered for every potentially suspicious action, then security is enhanced, but user productivity decreases due to frequent interruptions
Solution Approach 1:
The system applies partial intervention by selectively triggering user prompts only for actions with high risk scores. For low-risk actions, the system allows automatic execution without user interruption. This partial action approach maintains security protection for genuinely suspicious activities while preserving user productivity by eliminating unnecessary interruptions for benign actions.
Solution Approach 2:
The system performs preliminary reputation assessment and risk scoring before user interaction occurs. By pre-evaluating the executable object's reputation, publisher credibility, and intended action risk level, the system can make automated decisions for low-risk cases and reserve user prompts only for high-risk scenarios, thereby maintaining both security and productivity.
3Measurement precision
If a granular reputation system is implemented to differentiate between whitelisted, graylisted, and blacklisted actions, then detection precision is improved, but device complexity increases
Solution Approach 1:
The complex reputation system is segmented into modular components: file hash verification module, publisher credential verification module, action reputation analysis module, and contextual risk assessment module. Each module independently evaluates specific aspects and returns structured data that can be combined through standardized algorithms, making the overall complex system manageable and maintainable.
Solution Approach 2:
The system implements universal reputation assessment algorithms that can evaluate multiple types of executable objects (applications, scripts, installers) across different contexts (user actions, system actions, scheduled tasks) using the same core logic. This multi-functionality approach handles diverse security scenarios with a unified framework, reducing complexity compared to having separate specialized systems for each case.
Data Source
AI summary
There is disclosed in one example a server apparatus, including: a hardware platform including a processor and a memory; a network interface; and a vulnerability assessment server engine including instructions encoded within the memory to instruct the processor to: receive via the network interface an endpoint payload including a platform identification string, including an identifier for an application and an identifier for an action to be taken by the application; query a vulnerability database and platform identification string database to procure an application-specific reputation for the action; and send via the network interface the application-specific reputation for the action.