Network-Based Host Slowdown Detection for Malware Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods are ineffective in reliably detecting malware infections, particularly rootkits, as they often go unnoticed due to their ability to hide and evade detection by masking their activity, making it difficult to distinguish between infected and uninfected system states.
Innovation Solution
The approach involves passively observing and measuring host system slowdowns in response to known network events by comparing baseline and later response time information, using mechanisms external to the host system to detect changes indicative of malware infections, such as CPU cycles and I/O operations, and applying this data to control malware protection policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional scanning engines based on known bad file signatures are used to detect malware, then the detection process is simple and straightforward, but the detection reliability deteriorates because rootkits can mask their activity and hide malicious programs
Solution Approach 1:
The patent introduces an intermediary measurement mechanism that observes host system responses to network events from an external perspective. Instead of directly scanning for malware signatures (which rootkits can hide), the system measures network transaction response times as an indirect indicator of infection. This intermediary observation approach allows detection without directly encountering the masked malware, resolving the contradiction between detection reliability and mechanism complexity.
Solution Approach 2:
The patent replaces the mechanical scanning approach (signature-based detection) with a different measurement mechanism (network response time observation). Rather than directly examining files and processes for malware signatures, the system substitutes this with measuring network transaction characteristics, which provide indirect evidence of infection without requiring direct interaction with the masked malicious code.
2Measurement precision
If file-by-file comparison with an uninfected reference system is performed to detect rootkits, then detection accuracy is improved, but practical difficulties arise in maintaining and applying the reference copy
Solution Approach 1:
The patent enables the infected host system to essentially detect its own infection state through self-observation of network response characteristics. By measuring network transaction response times from the host itself (or through its network interface), the system performs self-diagnosis without requiring external reference systems. This self-service approach eliminates the need for maintaining uninfected reference copies while still providing precise infection detection.
3Difficulty of detecting and measuring
If host-based detection techniques are used to search for hidden files, folders, and processes, then detection capability is enhanced, but the effectiveness deteriorates because malware developers constantly evolve their products to evade such detection
Solution Approach 1:
The patent inverts the traditional detection approach by instead of searching for malware artifacts (files, processes, registry changes), it measures network transaction response characteristics. This inversion shifts the detection target from the malware itself to the impact of malware on network operations, creating a detection mechanism that is harder for malware developers to evade since it measures observable performance degradation rather than searching for hidden artifacts.
Data Source
AI summary
Host malware (or change) may be detected by (1) receiving baseline set of response time information for each of one or more transactions involving (A) the host and (B) at least one peer of the host, (2) determining or receiving a later set of response time information for each of the one or more transactions involving the host and the at least one peer of the host, and (3) determining whether or not host slowdown has occurred using the baseline set of response time information and the later set of response time information. The execution of a host malware (or change) protection policy may be controlled using at least the determination of whether or not host slowdown has occurred.