Auto-start Malware Detection via Load Point Behavior Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware systems fail to detect new or evolving malware that uses aggressive load point behaviors to persist across reboots, as they rely on signature-based detection methods that are ineffective against unknown or rapidly changing malware.
Innovation Solution
A system that monitors program behaviors targeting load points in the operating system, specifically detecting repeated write operations or automatic reset of load point values to identify and flag malicious programs, and takes actions such as removing or renaming entries to protect the system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection methods are used to identify malware, then known malware can be detected, but new or evolving malware that uses aggressive load point behaviors can go undetected
Solution Approach 1:
The system transitions from static signature-based detection to dynamic behavior-based detection. Instead of relying on fixed malware signatures, the system continuously monitors program behaviors at load points and adapts to detect new malware based on its aggressive persistence behaviors, such as repeatedly writing to load points to maintain presence across reboots.
Solution Approach 2:
The system performs preliminary monitoring of load point behaviors before malware can establish persistent infection. By watching for suspicious patterns like repeated write operations to load points, the system can identify and block new malware before it successfully compromises the system, rather than waiting for signature confirmation.
2Object-affected harmful factors
If conventional anti-malware checks are performed on load point files, then suspicious files can be identified, but new malware with legitimate characteristics can evade detection
Solution Approach 1:
The system implements continuous feedback monitoring of load point operations. By observing the behavior patterns of programs accessing load points over time, the system can identify malicious activities even when malware attempts to disguise itself with legitimate characteristics. The feedback loop allows the system to adapt its detection criteria based on observed behaviors.
Solution Approach 2:
The system introduces behavior analysis as an intermediary layer between the load point files and the detection mechanism. Instead of directly examining file characteristics, the system monitors the behavioral patterns of programs interacting with load points, serving as an intermediary that reveals malicious intent even when file signatures appear legitimate.
3Reliability
If load points are monitored for write operations, then aggressive malware behaviors can be detected, but system complexity increases
Solution Approach 1:
The system extracts and focuses monitoring efforts specifically on load point operations, separating this critical function from general system monitoring. By concentrating resources on watching write operations to load points, the system achieves reliable malware detection without the overhead of comprehensive system-wide monitoring, reducing overall complexity while maintaining detection effectiveness.
Data Source
AI summary
Program behaviors concerning load points are monitored, and a specific program attempting to actively maintain a previously set value of a specific load point is detected. In response, the specific program is adjudicated to be malware, and one or more actions are performed to protect the computer. The monitored behavior can be write operations targeting load points. In this scenario, the behavior indicating that a program is malware can comprise performing a requisite number of write operations to a load point within a requisite time period. The monitored behavior can also be altering load point values, and monitoring the results. The altering of load points can comprise removing values specifying programs to run, and/or changing names of programs. Detecting that a specific altered load point value has been automatically reset within a requisite time period to run the specific program upon start-up indicates that the program is malware.