Malware Detection via Auditable Event Logging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Anti-virus and anti-malware databases often update with a delay, leading to incomplete removal of malware components when multiple components infect a computer, as not all components are recognized by the software, allowing unknown malware to remain active undetected.
Innovation Solution
A system and method that logs auditable events such as attempts to create or modify executable files and write to the system registry, identifies and terminates malicious processes, deletes or quarantines affected files, and maintains a secure log for reconstruction of infection incidents, even after system reboot.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-malware software relies on database matching for detection, then known malware components are detected and removed, but unknown malware components remain undetected and active
Solution Approach 1:
The system performs preliminary actions by logging all file creation, modification, and process execution events before malware detection. This creates a complete audit trail that enables retrospective analysis of infection incidents, allowing the system to identify unknown malware components by examining what files and processes were created or modified during the infection event, even if those components are not yet in the malware database.
Solution Approach 2:
Instead of trying to detect all malware proactively through database matching, the system inverts the approach by using reactive analysis: when infection is detected (even partially), it reconstructs the entire infection incident by examining logs of file and process activities. This inversion allows the system to identify unknown malware components by analyzing the footprint they left during infection rather than trying to recognize them directly.
2Reliability
If anti-malware software performs comprehensive scanning of all files, then all malware components can be detected, but system performance and productivity deteriorate
Solution Approach 1:
The system segments the detection process into two distinct phases: (1) a lightweight continuous logging phase that captures only file creation, modification, and process execution events with minimal system overhead, and (2) a targeted analysis phase that reconstructs infection incidents only when needed. This segmentation allows comprehensive detection capability to be maintained without continuous performance degradation, as the heavy analysis is performed only reactively when infection is detected.
3Reliability
If anti-malware databases are updated frequently to include new malware, then detection capability improves, but the delay in updating databases allows unknown malware to remain active
Solution Approach 1:
The system performs preliminary logging of all relevant file and process events continuously, maintaining detailed records of what files were created, modified, or deleted and what processes were executed. This preliminary action ensures that when new malware appears, the system already has the audit trail data needed to identify it, eliminating the detection delay that occurs while waiting for database updates.
Solution Approach 2:
The system uses feedback from partial malware detections to trigger comprehensive incident reconstruction. When known malware components are detected, the system feeds this information back into the analysis engine, which then uses the pre-collected log data to reconstruct the full infection incident and identify associated unknown malware components, creating a feedback loop that continuously improves detection capability without requiring immediate database updates.
Data Source
AI summary
A system, method, and computer program product for identifying malware components on a computer, including detecting an attempt to create or modify an executable file or an attempt to write to a system registry; logging the attempt as an auditable event; performing a malware check on executable files of the computer; if malware is detected on the computer, identifying all other files created or modified during the auditable event, and all other processes related to the auditable event; terminating the processes related to the auditable event; deleting or quarantining the executable files created or modified during the auditable event; and if the deleted executable files include any system files, restoring the system files from a trusted backup. Optionally, all files and processes having a parent-child relationship to a known malware component or known infected file are identified. A log of auditable events is maintained, and is recoverable after system reboot.