Malicious Code Detection via Reputation Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud-based malicious code detection methods suffer from false positives due to the varying advantages and disadvantages of different detectors, affecting the accuracy of final detection results.
Innovation Solution
Assigning a credibility scale and reputation value to each testing result from multiple malicious code detectors, determining a final detection result based on these values to improve accuracy and reduce false positives, using a file reputation scoring policy and decision logic to adjust and consolidate the results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple malicious code detectors are used to test the sample, then the detection coverage is improved, but the false positive rate increases
Solution Approach 1:
The patent introduces a file reputation decider as an intermediary component that mediates between multiple malicious code detectors and the final detection result. This decider assigns credibility scales and reputation values to each detector's testing result, then aggregates them to produce the final result. The intermediary filters out false positives by weighing results according to their credibility and reputation, thus maintaining high detection coverage while reducing false positive rates.
Solution Approach 2:
The patent changes the parameter of result aggregation by introducing credibility scales and reputation values as weighting parameters. Instead of simple majority voting or equal weighting, each detector's result is weighted according to its assigned credibility and reputation parameters. This parameter-based aggregation method allows the system to maintain comprehensive detection coverage while reducing the impact of false positives from less reliable detectors.
2Productivity
If cloud-based detection is used, then the computing resources are improved, but the detection accuracy is reduced due to false positives
Solution Approach 1:
The file reputation decider serves as a cloud-based intermediary that aggregates results from multiple detectors while filtering false positives. It uses credibility scales and reputation values to weigh different检测结果, producing a more accurate final result. This intermediary layer maintains the cloud-based computing advantage while improving detection accuracy by systematically reducing false positives.
Solution Approach 2:
The system implements feedback mechanisms where the file reputation decider continuously evaluates the performance of multiple detectors and adjusts credibility scales and reputation values based on detected false positives. This feedback loop allows the cloud-based system to maintain high computing resource utilization while progressively improving detection accuracy by learning from and correcting false positive patterns.
Data Source
AI summary
The present application discloses a method and a system for detecting malicious code. The method comprises receiving a testing sample; testing the sample with a plurality of malicious code detectors to obtain a plurality of testing results; determining a credibility scale and a reputation value of each of the testing results, wherein the credibility scale indicates whether the testing result is malicious or safe, and the reputation value indicates a quantified trust level corresponding to the credibility scale; and determining a final detection result of the testing sample based on the determined credibility scales and the reputation values of the testing results. According to the technical solution of the present application, the testing results obtained from various malicious code detectors are rationally utilized to improve the testing accuracy for the malicious code.