Malicious Object Protection via Event Rollback and Network Termination
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus systems are ineffective in detecting and preventing malicious activities by new or unknown malware, and may be circumvented by malware exploiting system vulnerabilities, leading to unauthorized file, registry, and network activities that compromise data security.
Innovation Solution
A system comprising an antivirus database, an auditable event database, and modules for monitoring and recording events, performing malware checks, terminating malicious network connections, and rolling back malicious file and registry changes, utilizing signature and behavioral analysis to identify and mitigate threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional antivirus systems are used to detect malicious objects, then known malware can be identified, but new or unknown malware cannot be detected
Solution Approach 1:
The system performs preliminary actions by creating restoration points and recording system states before executing potentially malicious code. This allows the system to detect suspicious behaviors and rollback changes even when the malware is unknown, addressing the limitation of traditional signature-based detection
Solution Approach 2:
The system implements feedback mechanisms by monitoring system changes in real-time, comparing recorded events against expected behaviors, and automatically responding to detected anomalies. This continuous feedback loop enables detection of new malware through behavioral analysis rather than relying solely on known signatures
2Reliability
If antivirus systems are used to prevent malicious activities, then some threats can be blocked, but malware can still circumvent the system using vulnerabilities
Solution Approach 1:
The system applies preliminary anti-action by pre-recording system states and creating restoration points before malware execution. When malicious activities are detected, the system can immediately rollback changes, countering the malware's attempts to exploit system vulnerabilities before they cause permanent damage
Solution Approach 2:
The system provides beforehand cushioning by maintaining recorded system states and event logs that serve as a safety buffer. These recorded states act as a cushion against malicious activities, allowing the system to recover from attacks even when prevention mechanisms are circumvented
3Measurement precision
If comprehensive monitoring of all system events is implemented, then all malicious activities can be detected, but system performance and resource usage increase
Solution Approach 1:
The system extracts and records only specific critical events and changes that are relevant to malware detection, rather than monitoring all system events. This selective approach maintains detection effectiveness while reducing the overhead of comprehensive monitoring
Solution Approach 2:
The system implements partial monitoring by focusing on key system areas where malware typically operates (file system, registry, network connections). This partial action provides sufficient detection capability without the resource burden of complete system monitoring
Data Source
AI summary
Disclosed are systems, methods and computer program products for protecting a computer from activities of malicious objects. The method comprises: monitoring events of execution of one or more processes on the computer; identifying auditable events among the monitored events, including events of creation, alteration or deletion of files, events of alteration of system registry, and events of network access by processes executed on the computer; recording the identified auditable events in separate file, registry and network event logs; performing a malware check of one or more software objects on the computer; if an object is determined to be malicious, identifying from the file, registry and network event logs the events associated with the malicious object; performing rollback of file events associated with the malicious object; performing rollback of registry events associated with the malicious object; terminating network connections associated with the malicious object.