Graph-Based Malware Detection and Removal System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Signature-based approaches for malware removal are inadequate due to outdated signatures, machine-specific customization, active resistance by malware, and inefficiencies in kernel-mode operation, leading to incomplete and unsatisfactory removals.
Innovation Solution
A graph-based detection and removal system that combines a detection mechanism with a graph structure to accurately identify and remove malicious software by tracing relationships between processes and files, using a kernel-mode detection algorithm to ensure complete removal.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If signature-based detection is used, then detection simplicity is maintained, but detection accuracy deteriorates due to outdated signatures and malware evolution
Solution Approach 1:
The patent replaces the traditional signature-based detection mechanism with a behavioral analysis system that monitors system calls, registry modifications, and file operations. This substitution enables detection of malware based on its actions rather than static signatures, maintaining simplicity while significantly improving accuracy against evolving threats
Solution Approach 2:
The system changes the detection parameters from static file hashes and signatures to dynamic behavioral parameters including system call sequences, registry modification patterns, and file operation characteristics. This parameter transformation allows detection of malware variants without requiring updated signatures
2Ease of operation
If signature-based removal is used, then removal process is simple, but removal completeness deteriorates due to active malware resistance
Solution Approach 1:
The system performs preliminary behavioral monitoring and analysis before executing removal operations. By observing malware behavior patterns first, the system identifies all malicious components and their interdependencies, then executes a comprehensive removal sequence that prevents malware resistance mechanisms from interfering
Solution Approach 2:
The patent introduces a behavioral analysis intermediary layer that sits between the detection engine and removal execution. This intermediary analyzes system calls and operations to identify the full scope of malware activity, ensuring complete removal while maintaining operational simplicity through automated decision-making
3Measurement precision
If machine-specific customization is detected, then detection precision for individual infections improves, but system complexity increases
Solution Approach 1:
The system segments the detection process into modular behavioral analysis components that independently monitor different system areas (registry, files, processes). Each segment handles specific infection patterns, enabling precise detection of machine-specific customizations while maintaining overall system simplicity through modular architecture
Data Source
AI summary
Embodiments of the invention address the problem of removing malicious code from infected computers.