Malware Detection via Real-Time Behavior Vector Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods are inefficient in identifying new malware variants and consuming power, leading to delayed detection and increased time due to the need for multiple signature character strings, and lack effective solutions for preventing vulnerability attacks beyond patching.
Innovation Solution
An apparatus and method that models the behavior of computer programs in real time, using behavior vectors to determine if a program is malware, and receives system control signals to repair and prevent malware spread from a malware control server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional signature-based malware detection is used, then detection accuracy for known malware is improved, but detection speed deteriorates due to increasing numbers of signature character strings
Solution Approach 1:
The patent transforms the detection approach from signature-based (string matching) to behavior-based (parameter observation). Instead of comparing character strings, the system observes program behavior parameters such as file access patterns, registry modifications, and system calls to detect malware, thereby maintaining detection accuracy while improving speed
Solution Approach 2:
The patent replaces the mechanical string-matching mechanism with a behavioral analysis mechanism. Rather than mechanically comparing diagnostic strings against malware signatures, the system uses automated observation of program execution behavior to identify malware characteristics, reducing time consumption while maintaining detection effectiveness
2Adaptability or versatility
If multiple signature character strings are used to detect malware variants, then detection coverage is improved, but time consumption increases
Solution Approach 1:
The patent creates a universal behavioral analysis framework that can detect multiple malware variants simultaneously through a single detection mechanism. Instead of requiring separate signatures for each variant, the system observes common behavioral patterns across variants, enabling one detection system to handle diverse malware types efficiently
Solution Approach 2:
The system shifts from static signature parameters to dynamic behavior parameters. By monitoring how programs execute and interact with the system rather than what strings they contain, the detection method adapts to various malware variants without requiring additional signatures, thus reducing detection time while maintaining broad coverage
3Productivity
If real-time behavior modeling is implemented, then malware detection speed is improved, but system resource consumption increases
Solution Approach 1:
The patent applies partial monitoring by selectively observing only critical behavior parameters rather than all possible program actions. The system focuses on key indicators such as unauthorized file access, registry modifications, and suspicious system calls, thereby achieving effective malware detection while minimizing the computational overhead and power consumption associated with comprehensive behavior tracking
Data Source
AI summary
An apparatus and method of diagnosing whether a program executed in a computer system is malware and repairing the computer system infected by malware. The apparatus includes a receiving unit which receives a first behavior vector for the malware from a malware control server; a determination unit which determines whether a diagnostic target program corresponds to malware based on the received first behavior vector and a second behavior vector for the diagnostic target program; and a repair unit which repairs the computer system based on a result of the determination.A behavior of a computer program executed in the computer system may be modeled in real time.