Heuristic Malware Detection via Deviant Pattern Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods in computing environments are inefficient due to reliance on known signatures, manual configurations, and delayed responses, failing to provide early detection and containment of malware spread, especially when faced with obfuscation transformations.
Innovation Solution
A heuristic malware detection method that merges baseline file attributes from client computing systems into a centralized inventory, compares updated inventories to detect deviant patterns, classifies them as benign or malicious, and initiates removal processes for identified malware attacks, utilizing a remote malware detection authority with deviant pattern detection logic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional signature-based malware detection is used, then detection accuracy for known malware is improved, but response time to new malware attacks deteriorates due to time delays in signature extraction, database updates, and distribution
Solution Approach 1:
The system performs preliminary actions by continuously collecting and analyzing file attribute data from multiple client systems to establish baseline behavior patterns before malware attacks occur. This allows the system to detect deviations from normal behavior immediately when malware is introduced, eliminating the need to wait for signature extraction and database updates.
Solution Approach 2:
Instead of detecting malware by matching known signatures (traditional approach), the system inverts the approach by detecting what is abnormal or deviant from established baselines. This inversion allows detection of unknown malware based on behavioral anomalies rather than requiring prior knowledge of specific malware signatures.
2Measurement precision
If signature-based detection with manual configurations is used, then detection capability for known malware is improved, but adaptability to new malware threats deteriorates due to reliance on known repositories and human intervention
Solution Approach 1:
The system implements self-service by automatically collecting file attribute data, establishing baselines, detecting deviations, and responding to threats without requiring manual configuration or human intervention. This automated self-service enables the system to adapt rapidly to new malware threats by continuously learning from observed behavior patterns across the client community.
Solution Approach 2:
The system uses feedback mechanisms by continuously monitoring file attribute changes across multiple client systems and using this information to update baseline behaviors. This feedback loop enables the system to adapt to new threats by learning from actual observed behavior rather than relying on static signature databases that require manual updates.
3Reliability
If centralized malware management with database updates is used, then detection reliability for known malware is improved, but productivity deteriorates due to time delays in updating, distributing, and scanning
Solution Approach 1:
The system performs preliminary actions by pre-establishing baseline behavior patterns from aggregated file attribute data before threats occur. This allows immediate detection and response to deviations without waiting for centralized database updates, significantly improving productivity while maintaining reliability through continuous baseline monitoring.
Solution Approach 2:
The system replaces the mechanical process of centralized database updates, distribution, and scanning with an automated behavioral analysis mechanism. Instead of mechanically pushing signature databases to clients and scheduling scans, the system uses continuous background monitoring of file attributes with automatic deviation detection, eliminating the time delays inherent in the traditional mechanical update-and-scan approach.
4Reliability
If anti-virus programs and firewalls are used, then protection against known malware is improved, but ease of operation deteriorates due to mixed success rates and need for manual configurations
Solution Approach 1:
The system provides self-service protection by automatically establishing baselines, detecting threats, and initiating responses without requiring user configuration or intervention. This eliminates the operational complexity of traditional anti-virus programs while maintaining protection effectiveness through continuous automated monitoring of file attribute behaviors across the client community.
Data Source
AI summary
Embodiments of the present invention provide a method, system and computer program product for the heuristic malware detection. In one embodiment of the invention, a heuristic malware detection method can include merging a baseline inventory of file attributes for respective files from each client computing system in a community of client computing systems into a merged inventory. The method further can include receiving an updated inventory of file attributes in a current inventory survey from different ones of the client computing systems. Each received survey can be compared to the merged inventory, and in response to the comparison, a deviant pattern of file attribute changes can be detected in at least one survey for a corresponding client computing system. Thereafter, the deviant pattern can be classified as one of a benign event or a malware attack. Finally, malware removal can be requested in the corresponding client computing system if the deviant pattern is classified as a malware attack.