Kernel-Based Proactive Engine for Zero-Day Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection techniques are limited in effectively identifying malicious behavior, particularly in zero-day attacks, as they rely on signatures or behavior analysis, making it impossible to detect all improper behaviors, allowing malware creators to stay ahead of detection systems.
Innovation Solution
A kernel-based proactive engine that evaluates system call functions by generating feature vectors and using a multidimensional anomaly detection algorithm to block anomalous system calls, thereby detecting and preventing malicious activities even with previously unknown behaviors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection is used, then detection accuracy for known malware is improved, but detection capability against zero-day attacks deteriorates
Solution Approach 1:
Instead of detecting malware by matching known signatures, the patent inverts the approach by detecting anomalies in system call behavior that deviate from normal patterns. The anomaly detection engine identifies malicious activity by comparing observed system calls against established baselines of legitimate behavior, enabling detection of zero-day attacks without requiring prior knowledge of specific malware signatures.
Solution Approach 2:
The patent transforms the detection problem from signature matching to statistical analysis of system call parameters. By monitoring frequency, timing, and patterns of system calls rather than comparing against fixed signatures, the system adapts to detect previously unseen malware variants through behavioral anomalies in these parameters.
2Reliability
If behavior-based detection in sandbox is used, then detection of improper behavior is improved, but detection of previously unknown behaviors deteriorates
Solution Approach 1:
The patent performs preliminary analysis of system call patterns during normal system operation to establish baselines of legitimate behavior. This preliminary characterization of normal system call frequency, timing, and sequences enables the anomaly detection engine to identify deviations that indicate malicious activity, including previously unknown attack behaviors.
Solution Approach 2:
The system continuously monitors system call behavior and provides feedback to refine anomaly detection thresholds. By analyzing patterns over time and adjusting detection parameters based on observed behavior, the system improves its ability to detect novel threats while maintaining reliability in identifying improper behaviors.
3Device complexity
If traditional malware detection techniques are used, then implementation simplicity is maintained, but detection effectiveness against all malware deteriorates
Solution Approach 1:
The patent introduces an intermediary anomaly detection engine that operates between the kernel and user space to analyze system call behavior. This intermediary layer monitors system calls without requiring complex sandbox environments or frequent signature updates, providing effective detection across all malware types while maintaining relative implementation simplicity through modular architecture.
Data Source
AI summary
A kernel-based proactive engine can be configured to evaluate system call functions that are invoked when user-mode objects make system calls. As part of evaluating a system call function, the kernel-based proactive engine can generate a feature vector for the system call function. The kernel-based proactive engine can then analyze the feature vector using a multidimensional anomaly detection algorithm that has been trained using feature vectors of system call functions that are known to be safe. When the evaluation indicates that the feature vector is anomalous, the kernel-based proactive engine can block the system call.