Host-Level Malware Detection via Disposable Identifier Deletion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current host-level malware detection systems are inefficient in detecting sophisticated malware due to their reliance on signature-based methods, which are susceptible to zero-day attacks and require extensive resource usage, leading to prolonged detection times.
Innovation Solution
A computer-implemented method and system that accesses configuration parameters and identifiers of known malware and non-malware files, generates hashes for files entering a host, and sends files for analysis if they do not match known identifiers, using secure deletion techniques to maintain security and resource efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based malware detection methods are used, then known malware can be detected, but detection time increases and the system is vulnerable to zero-day attacks
Solution Approach 1:
The system performs preliminary actions by deleting configuration parameters, malware identifiers, and scanned files after the scanning process completes. This preliminary cleanup prevents malware from accessing detection data, eliminating the need for prolonged scanning operations and reducing detection time while maintaining reliability.
Solution Approach 2:
The patent treats configuration parameters and malware identifier databases as temporary, disposable objects that are deleted after use. This approach allows the system to operate with minimal persistent data storage, reducing the time malware has to detect and thwart the system while maintaining effective detection capabilities.
2Measurement precision
If comprehensive file system scanning is performed, then malware detection accuracy improves, but resource consumption increases
Solution Approach 1:
The system extracts and deletes only the essential data elements (configuration parameters and malware identifiers) after scanning completes, rather than maintaining comprehensive databases. This extraction approach maintains detection accuracy during the scan while minimizing resource consumption by removing unnecessary data persistence.
Solution Approach 2:
The patent implements a discard-and-recover mechanism where scanning data is temporarily held during the detection process, used for comprehensive analysis, then discarded through secure deletion. This allows high detection accuracy during the active scanning phase while recovering system resources immediately afterward, reducing overall resource consumption.
3Reliability
If malware identifiers are stored persistently, then detection reliability improves, but malware can detect and thwart the protection system
Solution Approach 1:
The system performs the preliminary action of deleting all configuration parameters and malware identifiers immediately after the scanning process completes. This timing ensures that malware has no opportunity to detect or thwart the protection system, as the detection data is removed before malware can analyze it, while still maintaining reliable detection during the active scanning phase.
Solution Approach 2:
The patent treats malware identifier databases as temporary, disposable objects that exist only during the active scanning process. This short-lived existence prevents malware from detecting and adapting to the protection system, as the identifiers are deleted before malware can analyze them, while maintaining detection reliability through comprehensive scanning during the brief period the data exists.
Data Source
AI summary
According to one embodiment, a computer-implemented method includes: accessing a set of configuration parameters, accessing a set of identifiers of files known not to be malware, and accessing a set of identifiers of files known to be malware. Further, the method includes: comparing a first file to the set of configuration parameters, determining that a first hash of the first file is not in the set of identifiers of files known not to be malware and that the first hash is not in the set of identifiers of files known to be malware, and sending the at least one file and information related to the at least one file to be analyzed for malware. The method includes deleting the set of configuration parameters, the set of identifiers of files known not to be malware, and the set of identifiers of files known to be malware after sending the first file.