Malware Detection via Dynamic Software Agent Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for detecting malicious software often rely on snapshot views and signature matching, which are ineffective against polymorphic malware that can remain dormant or change itself, leading to missed detections.
Innovation Solution
A software agent is assembled and transferred to a target system, performing both static and dynamic analyses on files to generate threat scores, allowing for real-time detection of malicious software based on aggregate threat scores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional snapshot view and signature matching methods are used, then detection simplicity is maintained, but detection effectiveness deteriorates against polymorphic and dormant malware
Solution Approach 1:
The patent transitions from static snapshot views to dynamic continuous monitoring. The software agent continuously collects system state information, file operations, and process behaviors, enabling detection of dormant and polymorphic malware that changes over time. This dynamic approach allows the system to adapt to evolving threats while maintaining comprehensive coverage.
Solution Approach 2:
The detection system is divided into multiple independent components: software agent for data collection, static analysis module for structure examination, dynamic analysis module for behavior monitoring, and scoring modules for different threat dimensions. This segmentation allows each component to specialize in specific detection tasks, improving overall effectiveness without requiring complete system redesign.
2Measurement precision
If static analysis only is performed, then analysis speed is maintained, but detection accuracy deteriorates for polymorphic malware
Solution Approach 1:
The system performs static analysis on all files to generate baseline threat scores, then applies dynamic analysis selectively based on static analysis results and risk thresholds. This partial application of excessive action (dynamic analysis) ensures high detection accuracy for suspicious files while avoiding unnecessary time consumption on clearly benign files.
Solution Approach 2:
The system uses aggregate threat scoring that combines multiple parameters (static analysis score, dynamic behavior score, risk level) to determine final detection outcomes. By changing from single-parameter detection to multi-parameter aggregation, the system achieves higher precision while managing analysis time through weighted scoring mechanisms.
3Reliability
If comprehensive static and dynamic analysis is performed on all files, then detection accuracy improves, but system resource consumption increases
Solution Approach 1:
The system applies comprehensive static and dynamic analysis only to files that meet specific criteria (e.g., unknown signatures, high-risk file types, abnormal behavior patterns). Benign files with known signatures are processed through lightweight verification only, significantly reducing overall resource consumption while maintaining high detection reliability for malicious files.
Solution Approach 2:
The software agent autonomously determines which files require comprehensive analysis based on static analysis results, file metadata, and system context. This self-service mechanism eliminates the need for external resource allocation decisions, allowing the system to dynamically optimize resource usage based on actual threat levels without manual intervention.
Data Source
AI summary
In systems and methods of detecting malicious software, a software agent comprising at least one scan module is assembled by a source system and is transferred by the source system to a target system. In response to a connection request from the software agent a connection is established to the software agent and a file is received from the target system. At the source system, a static analysis is performed on the transferred file to generate a static threat score, and a dynamic analysis is performed to generate a dynamic threat score. Based on the static threat score and the dynamic threat score an aggregate threat score is generated for the transferred file.