Malicious Process Tracking via Iterative History Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malicious software removal tools focus on deleting identified malicious files but fail to account for changes made by the software, such as registry modifications and downloaded malware, lacking comprehensive tracking and analysis of the software's actions and related processes.
Innovation Solution
A method and system for tracking malicious processes by obtaining process history information, identifying associated and related processes, and generating tracking information to provide a comprehensive graph of actions, allowing for thorough detection and removal of malware effects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If malicious software removal tools focus only on deleting detected malicious files, then the removal process is simple and fast, but the tools fail to account for changes made by the malicious software such as registry modifications and downloaded malware
Solution Approach 1:
The system performs preliminary actions by obtaining process history information and identifying associated processes before the actual malware removal. This allows the system to document all changes made by malware (registry modifications, downloaded files, etc.) in advance, ensuring comprehensive tracking information is captured before deletion occurs, thus resolving the contradiction between fast removal and complete tracking
2Reliability
If the system performs comprehensive tracking of all malware actions and related processes, then the detection and removal effectiveness is improved, but the complexity of the removal tool increases
Solution Approach 1:
The system segments the malware removal process into distinct functional modules: obtaining process history information, identifying associated processes, identifying actions of processes, iteratively identifying related processes, and generating tracking information. This segmentation allows each module to perform a specific function, making the overall complex system more manageable and maintainable while achieving comprehensive tracking and effective removal
3Loss of information
If the system iteratively identifies related processes and their actions, then comprehensive tracking information is generated, but the time required for analysis increases
Solution Approach 1:
The system applies partial action by iteratively identifying related processes only to the extent necessary for comprehensive tracking. Rather than analyzing every possible process on the system, the iterative identification focuses specifically on processes related to the detected malware and its actions, obtaining process history information and identifying associated processes only when relevant to the malware investigation, thus balancing completeness with time efficiency
Data Source
AI summary
Malicious processes may be tracked by obtaining process history information of a computing device and obtaining an identification of a malicious software on the computing device. An associated process of the malicious software and actions of the associated process may be identified based on the process history information. Related processes of the associated process and actions of the related processes may be iteratively identified based on the process history information. Tracking information for the malicious software may be generated based on the associated process, the actions of the associated process, the related processes, and the actions of the related processes.