Malware Detection via Call Pattern Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection mechanisms often result in an undesired number of false positives by analyzing series of call types indicative of malicious behavior, which can lead to incorrect identification of software components.
Innovation Solution
Monitoring and analyzing a series of call types to named components within a data processing system, using a protection engine and virus protection system that includes system emulation, behavior analysis, and a policy to determine if the calls indicate malicious behavior, thereby reducing false positives and improving detection of malicious software components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature detection is used to identify malware, then detection accuracy for known viruses is improved, but the system cannot detect unknown or new viruses
Solution Approach 1:
The patent segments malware detection into two distinct approaches: signature-based detection for known viruses and behavior-based analysis for unknown threats. This segmentation allows the system to apply the appropriate detection method based on the malware type, resolving the contradiction between detection accuracy for known viruses and adaptability to unknown threats
Solution Approach 2:
The patent introduces behavior analysis as an intermediary mechanism that bridges signature-based detection and unknown malware identification. By analyzing software component behavior patterns, the system can detect unknown malware that lacks known signatures, while still maintaining the ability to accurately identify known viruses through signature matching
2Adaptability or versatility
If behavioral analysis is used to identify unknown malware, then adaptability to new threats is improved, but the system generates an undesired number of false positives
Solution Approach 1:
The patent implements feedback mechanisms where behavior analysis results are continuously refined based on comparison with known virus signatures and system responses. This feedback loop allows the system to learn from false positives and improve the reliability of behavioral analysis over time, reducing false positives while maintaining adaptability to new threats
Solution Approach 2:
The patent merges signature-based detection and behavior-based analysis into a unified detection system. By combining these two approaches, the system leverages the accuracy of signature matching to validate behavioral analysis results, thereby reducing false positives while maintaining the ability to detect unknown malware
3Adaptability or versatility
If emulation and simulation are used to analyze software behavior, then detection of unknown malware is improved, but system complexity and processing time increase
Solution Approach 1:
The patent applies preliminary action by pre-defining behavior patterns and analysis rules that software components should follow. Rather than creating complex emulation environments, the system establishes predetermined behavioral expectations and compares actual component behavior against these patterns, simplifying the detection mechanism while maintaining effectiveness
Data Source
AI summary
A computer implemented method, apparatus, and program code for detecting malicious software components. A series of calls made by a software component is monitored to identify an identified respective series of call types to components named in said calls. A determination is made as to whether the identified respective series of call types to components named in said calls is indicative of malicious behavior.