Malicious System Detection via Multidimensional State Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus technologies struggle to detect malicious computer systems that employ countermeasures to evade detection, such as code obfuscation and behavior masking, making it difficult to identify and prevent targeted cyber attacks.
Innovation Solution
A system and method that collect and analyze characteristics of a computer system, including computing resources, software, and data processing, to determine relations and time dependencies, and compare these against patterns to assess the degree of harmfulness, using a multidimensional space representation and threshold evaluation to differentiate between legal and malicious systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional antivirus detection methods (signature analysis, heuristic analysis) are used, then detection capability against known malware is improved, but detection capability against obfuscated and behavior-masked malware deteriorates
Solution Approach 1:
The patent transitions from analyzing individual program characteristics to analyzing the system state in multidimensional space. Instead of examining single features like code signatures or isolated behavior patterns, the system evaluates multiple characteristics simultaneously (CPU usage, memory allocation, network activity, file operations) to form a comprehensive state vector that captures the holistic behavior of the system, making it difficult for malware to evade detection through localized obfuscation techniques.
Solution Approach 2:
The system dynamically adjusts detection parameters and thresholds based on the analyzed system state. Rather than using fixed detection rules, the patent modifies sensitivity levels, time windows, and evaluation criteria according to the observed system characteristics, enabling adaptive detection that responds to different malware behaviors and countermeasure techniques.
2Measurement precision
If comprehensive system characteristics are collected and analyzed, then detection accuracy is improved, but computational complexity and analysis time increase
Solution Approach 1:
The patent extracts only the most relevant characteristics from the comprehensive system state for final detection decisions. While the system collects and monitors multiple parameters, it identifies and focuses on the critical subset of features that most strongly indicate malicious activity, reducing the complexity of the analysis while maintaining high detection accuracy.
Solution Approach 2:
The detection process is divided into distinct stages: data collection, state determination, characteristic extraction, and final analysis. Each stage processes specific aspects of the system state independently, allowing parallel processing and optimization of individual components without increasing overall system complexity.
3Loss of time
If real-time system monitoring is implemented, then early detection capability is improved, but system performance overhead increases
Solution Approach 1:
The system implements selective monitoring that focuses computational resources on the most critical system activities and high-risk operations. Rather than uniformly analyzing all system events at maximum depth, it applies partial monitoring to low-risk operations and excessive (detailed) monitoring only when suspicious patterns are detected, balancing early detection capability with minimal performance overhead.
Data Source
AI summary
Disclosed are systems and method for detecting a malicious computer system. An exemplary method comprises: collecting, via a processor, characteristics of a computer system; determining relations between collected characteristics of the computer system; determining a time dependacy of at least one state of the computer system based on determined relations; determining the at least one state of the computer system based at least on determined time dependacy; and analyzing the at least one state of the computer system in connection with selected patterns representing a legal or malicious computer system to determine a degree of harmfulness of the computer system.