Malicious Activity Detection via Filter and Analysis Modules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious activity in processing systems are inefficient, as they either rely on process-intensive signature comparison or generate high false positives, failing to detect new types of malware and hampering system performance.
Innovation Solution
A method that intercepts activities in a processing system, using a filter module to determine if they are suspicious based on pre-defined rules, and an analysis module to detect malicious activity by comparing sequences of events, thereby reducing false positives and improving detection efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature comparison methods are used to detect malicious activity, then detection capability for known malware is improved, but processing time and system performance deteriorate due to process-intensive comparison
Solution Approach 1:
The detection system is segmented into multiple functional modules: a hook management module that manages API hooks, a filter module that applies rules to intercept activities, and an analysis module that compares sequences of events. This segmentation allows each module to handle specific tasks efficiently, reducing the overall processing burden compared to monolithic signature comparison approaches.
Solution Approach 2:
The system performs preliminary actions by establishing hook chains before malicious activity occurs, and by pre-defining filter rules for intercepting activities. The analysis module also prepares sequence patterns in advance for comparison. These preliminary preparations enable faster detection without requiring intensive real-time processing.
2Adaptability or versatility
If broad filtering rules are applied to intercept activities, then detection coverage for various malware types is improved, but false positives increase due to overly broad criteria
Solution Approach 1:
The filter module applies different filtering criteria to different types of activities and entities. Instead of using a single broad rule set, the system tailors filter rules to specific contexts (e.g., different API calls, different entities involved), allowing precise interception of malicious activities while minimizing false positives through localized, context-aware filtering.
Solution Approach 2:
The analysis module provides feedback by comparing sequences of events and determining whether intercepted activities are truly suspicious or benign. This feedback mechanism allows the system to refine its detection accuracy, reducing false positives by validating suspicions against established patterns of legitimate versus malicious behavior.
3Reliability
If comprehensive analysis of all activities is performed, then detection accuracy for new malware types is improved, but processing overhead increases due to analyzing every event
Solution Approach 1:
The filter module extracts and isolates only the suspicious activities that require further analysis by comparing them against defined filter rules. This extraction process separates benign activities from potentially malicious ones, allowing the analysis module to focus its resources only on the latter, thereby reducing overall processing overhead while maintaining high detection accuracy.
Solution Approach 2:
The system applies partial analysis by using filter rules to pre-screen activities before comprehensive analysis. Not all activities undergo full analysis - only those that pass the filter threshold do. This partial action approach reduces processing overhead for the majority of benign activities while ensuring thorough analysis of suspicious ones.
Data Source
AI summary
A method, system, computer program product and/or computer readable medium of instructions to detect malicious activity. The method comprises intercepting an activity in a processing system, wherein a requesting entity requests the activity to be performed in relation to a target entity; determining, using a filter module if the activity is suspicious or non-suspicious; and in response to determining that the activity is suspicious, analysing at least one of the activity, the requesting entity and the target entity using an analysis module to detect malicious activity. There is also disclosed a method, system, computer program product and/or computer readable medium of instructions to facilitate the detection of malicious activity.