Malware Detection via Behavior Vector Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional malware detection methods, such as signature-based detection, are ineffective in identifying unknown malware and are resource-intensive, particularly on mobile devices, leading to delays and high processor and memory usage.
Innovation Solution
A computing device and server system that utilizes a query logger, behavior analysis engine, and classifier to analyze application behavior and generate behavior vectors, classifying applications as benign or malware, reducing resource usage and enabling quicker detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based malware detection is used, then detection accuracy for known malware is improved, but processor and memory usage increases significantly
Solution Approach 1:
The patent extracts only the essential behavioral characteristics of applications (behavior vectors) rather than analyzing complete application signatures. The query logger extracts specific behavioral data points (permissions used, APIs called, system calls made) and the behavior analysis engine processes only these extracted features, significantly reducing computational resources while maintaining detection effectiveness.
Solution Approach 2:
The patent uses lightweight behavior vectors as temporary, disposable representations of application behavior instead of maintaining heavy signature databases. Each application generates a behavior vector that is processed immediately for classification, then discarded, eliminating the need for persistent storage of large signature datasets and reducing memory requirements.
2Measurement precision
If signature-based malware detection is used, then detection capability for known malware is improved, but detection speed decreases due to resource intensity
Solution Approach 1:
The patent performs preliminary action by logging application behavior as it naturally occurs during normal operation. The query logger continuously monitors and records behavioral data in real-time, building up a behavior profile before formal analysis is needed. This preliminary data collection eliminates the need for resource-intensive on-demand signature matching, enabling faster detection when analysis is required.
3Measurement precision
If traditional malware detection methods are used, then detection of known malware variants is improved, but adaptability to unknown malware decreases
Solution Approach 1:
The patent implements dynamics by using a classifier that can adapt its decision boundaries based on learned patterns from behavior vectors. The system dynamically adjusts to new malware types by analyzing their behavioral characteristics and updating classification models, enabling detection of both known and unknown malware variants without requiring pre-programmed signatures for each variant.
4Measurement precision
If signature updates are implemented frequently, then detection accuracy for new malware is improved, but device resource consumption and update overhead increase
Solution Approach 1:
The patent implements self-service by enabling devices to autonomously detect and classify malware using locally processed behavior vectors without requiring external signature updates. The system serves itself by learning from observed application behaviors and making independent detection decisions, eliminating the need for frequent manual or automated signature database updates and associated overhead.
Data Source
AI summary
Disclosed is an apparatus and method for a computing device to determine if an application is malware. The computing device may include: a query logger to log the behavior of the application on the computing device to generate a log; a behavior analysis engine to analyze the log from the query logger to generate a behavior vector that characterizes the behavior of the application; and a classifier to classify the behavior vector for the application as benign or malware.