Graph-Based Malware Detection and Removal System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Signature-based approaches for malware removal are inadequate due to outdated signatures, machine-specific customization, active resistance by malware, and inefficiencies in detecting and removing kernel-mode malware, leading to incomplete and unsatisfactory removals.
Innovation Solution
A graph-based detection and removal system that combines a detection mechanism with a graph structure to accurately identify and remove malicious software by tracking processes and files, using behavioral events and graph rules to determine maliciousness and implement precise removal actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based approaches are used for malware detection and removal, then the system can identify known malware patterns, but the signatures become outdated and fail to detect modified or customized malware variants
Solution Approach 1:
The system performs preliminary actions by monitoring and recording the behavior of programs during their execution. It captures behavioral events, file system changes, registry modifications, and process interactions before malware can modify itself or evade detection. This preliminary behavioral recording enables the system to detect malware based on its actions rather than static signatures, resolving the contradiction between initial detection accuracy and long-term reliability.
2Device complexity
If the removal program runs in user mode with signature-based schemes, then the system can operate without kernel-level complexity, but it cannot effectively remove recalcitrant malware that actively resists removal
Solution Approach 1:
The patent introduces an intermediary component - a kernel-mode driver or filter - that acts as a mediator between the user-mode removal program and the operating system kernel. This intermediary provides the removal program with elevated privileges and direct access to system resources without requiring the entire removal system to run in kernel mode. The intermediary enables the program to terminate resistant processes, delete protected files, and modify registry keys while maintaining the simplicity of user-mode operation for the main removal logic.
3Measurement precision
If undo systems record all actions of majority programs to identify malware, then comprehensive malware detection is achieved, but large amounts of storage are required
Solution Approach 1:
Instead of uniformly recording all actions of all programs, the system applies local quality by selectively monitoring and recording only the behavioral events that are characteristic of malware. It focuses on capturing specific types of actions such as attempts to modify system-wide settings, unusual file creation patterns, registry key modifications in critical areas, and process injection behaviors. This selective recording approach maintains high malware identification accuracy while significantly reducing the storage requirements compared to recording all program actions.
4Productivity
If signature-based schemes do not implement removal in the kernel, then scanning efficiency is maintained, but the system cannot effectively deal with kernel mode malware or recalcitrant user mode malware
Solution Approach 1:
The system segments the malware removal functionality into distinct components operating at different privilege levels. The user-mode component handles scanning, signature matching, and coordination tasks, maintaining high scanning efficiency. The kernel-mode component handles privileged operations such as terminating resistant processes, deleting protected files, and modifying system-critical registry keys. This segmentation allows the system to maintain scanning efficiency in user mode while achieving reliable removal of recalcitrant malware through kernel-mode operations.
Data Source
AI summary
Systems and methods for protecting from harmful software on a computer are disclosed. The systems and methods may include observing potentially harmful software on the computer at runtime, determining that at least part of the potentially harmful software is harmful software and removing effects of the harmful software from the computer based on at least the observing and the determining, despite attempts by the harmful software to resist the removing.