Imposter Process Detection via Attribute Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional signature-based malware-detection methods fail to detect imposter processes and additional malware, as they often modify their signatures to evade detection, and may pose as legitimate programs, leading to compromised computer security.
Innovation Solution
A system and method that compares attributes of processes to legitimate ones to identify imposter processes, determines security actions for files created by these processes, and applies heightened security analysis, including name, path, digital signature, and hash comparisons, to detect and contain potentially malicious files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature-based malware-detection mechanisms are used, then detection of known malware is achieved, but detection of imposter processes and modified malware fails
Solution Approach 1:
The system performs preliminary actions by comparing process attributes against legitimate process profiles before malware execution can cause harm. The imposter process detection mechanism proactively identifies suspicious processes by comparing their attributes (name, path, digital signature, hash) against known legitimate processes, enabling early detection before the malware can modify its signature or evade detection.
Solution Approach 2:
The system creates and maintains copies of legitimate process profiles (name, path, digital signature, hash) as reference standards. By comparing suspicious processes against these copied profiles, the system can identify imposter processes that attempt to mimic legitimate software, thereby detecting malware that has modified its signature to evade traditional detection.
2Productivity
If imposter processes are allowed to run, then system performance is maintained, but security is compromised through additional malware placement
Solution Approach 1:
The system introduces an intermediary security layer that monitors and analyzes process attributes between the execution of suspicious processes and their potential harmful actions. The imposter process detection mechanism acts as a mediator by comparing process characteristics against legitimate profiles and intercepting potentially malicious processes before they can place additional malware on the system, thus maintaining security without completely blocking legitimate operations.
3Measurement precision
If heightened security analysis is applied to all files, then detection accuracy improves, but computing resource consumption increases
Solution Approach 1:
The system applies local quality by implementing differentiated security analysis based on process characteristics. Instead of applying uniform heightened security analysis to all files, the system selectively applies enhanced scrutiny only to files associated with imposter processes identified through attribute comparison. This localized approach maintains high detection accuracy for suspicious files while avoiding unnecessary resource consumption on files from legitimate processes.
Data Source
AI summary
A computer-implemented method for securing computing devices against imposter processes may include (1) identifying a process that is subject to a security assessment, (2) determining, based on comparing an attribute of the process to an attribute of a legitimate process, that the process comprises an imposter process of the legitimate process, (3) determining that a file may have been created by the imposter process, and (4) determining a security action for the file in response to determining that the file has been created by the imposter process. Various other methods, systems, and computer-readable media are also disclosed.