Isolated ML File Analysis for Malicious Attack Prevention

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional application execution control systems rely on static signature databases that require frequent updates and significant resource overhead, and inefficiently analyze files for security issues using the same processing cores as for execution, leading to reduced control and increased management burden.

Innovation Solution

Implementing a machine learning model in an isolated operating environment to determine whether a file is safe for processing by analyzing it separately from the primary operating environment, allowing safe files to be processed while preventing unsafe files from executing, and using a cloud-based network for remote analysis if necessary.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional signature databases are used for application execution control, then file safety determination can be made, but frequent database updates are required and significant resource overhead is consumed

Engineering Contradiction:

Improvefile safety determinationVSAvoiddatabase update management

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the file analysis function from the primary processing core and places it in a separate isolated environment. This allows the primary system to focus on execution while the isolated environment handles security analysis independently, eliminating the need for continuous database updates in the primary system and reducing resource overhead.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The isolated environment acts as an intermediary between the file and the primary operating system. It receives files for analysis, performs security checks using machine learning models, and only allows safe files to proceed to the primary environment, thereby mediating the interaction and eliminating direct database dependency.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Use of energy by moving object

If the same processing cores are used for both execution and security analysis, then resource utilization is maximized, but execution control efficiency and correctness are reduced

Engineering Contradiction:

Improveresource utilizationVSAvoidexecution control efficiency

Core Design Contradiction:

Use of energy by moving objectVSProductivity

Solution Approach 1:

The patent segments the processing functions by creating a separate isolated environment for security analysis. This segmentation allows dedicated processing resources for analysis without interfering with execution processes, thereby improving execution control efficiency while still utilizing resources effectively through parallel processing.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a new dimensional separation by creating an isolated environment that operates independently from the primary processing cores. This dimensional change allows security analysis to occur in a separate computational space, eliminating resource conflicts and improving overall system efficiency.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

3Ease of manufacture

If static signature databases are used for application control, then implementation is simple, but the ability to control execution correctly reduces as databases grow

Engineering Contradiction:

Improveimplementation simplicityVSAvoidexecution control accuracy

Core Design Contradiction:

Ease of manufactureVSReliability

Solution Approach 1:

The patent changes the fundamental parameter of security analysis from static database signatures to dynamic machine learning models. This parameter change allows the system to adapt to new threats automatically without requiring database updates, maintaining high reliability even as the analysis capacity grows.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent replaces the mechanical database signature matching system with a machine learning-based analysis system. This substitution eliminates the limitations of static databases and provides more accurate and adaptable execution control while maintaining implementation simplicity through automated analysis.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS11182471B2Isolating data for analysis to avoid malicious attacks

Publication Date: 2021.11.23 CYLANCE INC

AI summary

Determining, by a machine learning model in an isolated operating environment, whether a file is safe for processing by a primary operating environment. The file is provided, when the determining indicates the file is safe for processing, to the primary operating environment for processing by the primary operating environment. When the determining indicates the file is unsafe for processing, the file is prevented from being processed by the primary operating environment. The isolated operating environment can be maintained on an isolated computing system remote from a primary computing system maintaining the primary operating system. The isolating computing system and the primary operating system can communicate over a cloud network.