Malicious Module Identification via Contradiction Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies fail to accurately identify and deactivate malicious modules, as detection modules themselves can be tampered with, leading to improper updates and exposure of confidential data.
Innovation Solution
A malicious-module identification device that receives tampering detection results from multiple modules, determines contradictions in these results to identify a malicious module, and outputs instructions to deactivate it, using a logical detection method to ensure accurate identification and removal.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single detection module is used to identify malicious modules, then the device complexity is reduced, but the reliability of malicious module identification deteriorates because the detection module itself can be tampered with
Solution Approach 1:
The detection system is divided into multiple independent detection modules (first detection module, second detection module, etc.), each capable of autonomously detecting the same target module. This segmentation ensures that no single module is a single point of failure and allows for cross-verification of detection results, thereby improving reliability while maintaining manageable system complexity.
Solution Approach 2:
The system implements a feedback mechanism where detection results from multiple modules are aggregated and analyzed. The identification result is determined based on the consensus or majority vote of multiple detection modules, creating a feedback loop that enhances the reliability of malicious module identification by leveraging collective detection capability.
2Reliability
If multiple detection modules are deployed to improve identification reliability, then the reliability of malicious module identification improves, but the device complexity increases
Solution Approach 1:
Multiple detection modules are designed with identical or similar functional capabilities, each capable of performing the same detection task independently. This universality allows the system to achieve improved reliability through redundancy without requiring complex specialized components for each module, thereby limiting the increase in device complexity.
Solution Approach 2:
The system merges the detection results from multiple independent modules through a centralized identification unit that aggregates the results. This combining approach allows the benefits of multiple modules to be realized while consolidating the complexity of result processing into a single unit, thereby managing overall system complexity.
3Reliability
If detection modules monitor each other in a chain structure, then the reliability of detection is improved, but the device complexity and difficulty of detecting and measuring increase
Solution Approach 1:
The monitoring function is segmented and distributed across multiple detection modules, where each module monitors both external targets and other detection modules. This segmentation creates a distributed monitoring network that improves detection integrity while keeping each individual module's monitoring task manageable, thereby limiting the overall difficulty of detecting and measuring tampering.
Data Source
AI summary
A malicious-module identification device identifies and deactivates a malicious module operating in an information processing device connected thereto via a network. The malicious-module identification device is provided with a reception unit for receiving results of tampering detection from a plurality of modules for detecting tampering, and a determination unit for assuming that a module among the plurality of modules is a normal module, determining, based on the assumption, whether a contradiction occurs in the received results of tampering detection and identifying the module assumed to be a normal module as a malicious module when determining that a contradiction occurs. A deactivation unit outputs an instruction to deactivate the module identified as the malicious module.