Malicious Program Identification via Pre-User Sensitive Action Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security programs are ineffective in detecting malicious software that employs polymorphism or evades detection by not interacting with the user before performing sensitive actions, leading to potential harm to computing devices.
Innovation Solution
A method that identifies data objects requesting sensitive actions before user interaction, classifies them as high-risk, and takes corrective actions such as termination, sandboxing, or quarantining, while examining requests through a sandboxed environment or execution manager to prevent malicious behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security programs use traditional detection methods, then they can detect known malware, but they cannot detect malicious software that employs polymorphism or evades detection by not interacting with the user before performing sensitive actions
Solution Approach 1:
The system performs preliminary analysis of data objects by monitoring their execution behavior and detecting sensitive actions before they can cause harm. The security program intercepts and analyzes API calls, file operations, and system modifications during controlled execution, allowing detection of malicious intent before the malware can fully operate or evade detection through user interaction delays
Solution Approach 2:
The patent introduces an intermediary analysis layer that sits between the data object execution and the actual system operations. This intermediary monitors and intercepts sensitive actions, analyzing their context and behavior patterns to detect malware regardless of whether the malware attempts user interaction or employs polymorphic techniques. The intermediary captures execution traces and evaluates them against security policies
2Ease of operation
If the system allows data objects to execute freely, then user experience is maintained, but malicious data objects can cause damage before detection
Solution Approach 1:
An intermediary security layer is introduced that transparently monitors data object execution without disrupting the user experience. The intermediary intercepts sensitive system calls and file operations, analyzing their context to determine if they constitute malicious behavior. Legitimate applications continue to run smoothly while malicious ones are detected and blocked, maintaining ease of operation for users while preventing harm
3Measurement precision
If the system performs extensive analysis on all data objects, then detection accuracy improves, but system performance and execution speed decrease
Solution Approach 1:
The system applies different levels of analysis to different data objects based on their characteristics and risk profiles. High-risk objects exhibiting suspicious behavior patterns undergo extensive analysis, while low-risk objects receive minimal or no analysis. The system dynamically adjusts monitoring intensity based on contextual factors such as the type of operations being performed, the source of the data object, and the current system state, optimizing both detection precision and execution speed
Data Source
AI summary
An execution of a data object is identified by a computing device. In response to identifying the execution of the data object, it is determined that the data object has requested a sensitive action of the computing device before interacting with a user of the computing device. In response to determining that the data object has requested the sensitive action, the data object is classified as a high-risk data object.