Hygiene-Based Reputation Scoring for Targeted Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security software struggles to detect targeted malware threats due to their limited distribution, which makes signature scanning and heuristic techniques less effective, and security companies face challenges in evaluating and prioritizing malware submissions to focus on the greatest threats.
Innovation Solution
A system and method that determine hygiene scores for clients to assess their trustworthiness, calculate reputation scores for entities based on client hygiene scores, and use these scores to evaluate the maliciousness of encountered entities, leveraging collective intelligence to assign risk assessments to files, websites, and other entities without explicit evaluation or sophisticated analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature scanning and behavior monitoring heuristics are used to detect malware, then mass-distributed malware can be detected and disabled, but targeted malware threats become harder to detect due to their limited distribution
Solution Approach 1:
The patent segments the malware detection problem into two distinct approaches: signature-based detection for mass-distributed malware and reputation-based detection for targeted malware. This segmentation allows each method to be optimized for its specific threat type, resolving the contradiction between detecting common vs. targeted threats
Solution Approach 2:
The patent changes the detection parameter from signature matching to hygiene score-based reputation assessment. By transitioning to a different detection parameter (hygiene scores that reflect user behavior patterns), the system becomes effective against targeted malware while maintaining capability against mass-distributed threats
2Reliability
If security companies analyze malware submissions to develop detection techniques, then detection capabilities improve, but the large number of submissions makes it difficult to prioritize and focus on greatest threats
Solution Approach 1:
The patent applies preliminary action by pre-calculating hygiene scores for all malware submissions before human analysis. This preliminary scoring based on automated hygiene metrics allows security companies to prioritize submissions in advance, focusing expert analysis on the most threatening malware first and significantly reducing evaluation time
3Quantity of substance
If malware automatically generates new code for every few visitors, then malware becomes widely-distributed, but signature scanning becomes impractical since few users have the exact same code
Solution Approach 1:
The patent inverts the detection approach by instead of trying to match identical signatures across distributed malware instances, it aggregates hygiene score data from multiple infected systems to build a reputation profile. This inversion allows detection of polymorphic malware that continuously changes its code while maintaining harmful behavior patterns
Data Source
AI summary
A reputation server is coupled to multiple clients via a network. Each client has a security module that detect malware at the client. The security module computes a hygiene score based on detected malware and provides it to the reputation server. The security module monitors client encounters with entities such as files, programs, and websites. When a client encounters an entity, the security module obtains a reputation score for the entity from the reputation server. The security module evaluates the reputation score and optionally cancels an activity involving the entity. The reputation server computes reputation scores for the entities based on the clients' hygiene scores and operations performed in response to the evaluations. The reputation server prioritizes malware submissions from the client security modules based on the reputation scores.