File-Modifying Malware Detection via Behavioral Pattern Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods often fail to detect file-modifying malware, such as wipers and ransomware, until significant data damage has occurred, due to their ability to modify data without altering entropy levels or being mistaken for benign applications, leading to false positives and high computational costs.
Innovation Solution
A system and method that monitors processes traversing the directory and accessing files according to defined file access patterns, correlating actions to determine malicious behavior and taking preventative actions without user authorization, such as stopping the malware execution, to prevent further data alteration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based malware detection is used, then known malware can be detected and removed, but sophisticated file-modifying malware can evade detection until significant damage occurs
Solution Approach 1:
The patent implements preliminary action by monitoring file access patterns before malware completes its destructive actions. The system establishes baseline file access behavior and detects deviations that indicate malware activity early in the infection cycle, preventing significant data damage before it occurs.
Solution Approach 2:
The patent applies dynamics by transitioning from static signature-based detection to dynamic behavior-based detection. The system continuously learns and adapts to normal file access patterns, enabling it to detect malware that modifies files in sophisticated ways while maintaining low false positive rates.
2Reliability
If comprehensive file monitoring is implemented to detect all file modifications, then malware can be detected early, but computational costs and false positives increase significantly
Solution Approach 1:
The patent implements local quality by focusing monitoring resources on specific high-risk file types and directories where malware most commonly targets data. Instead of uniformly monitoring all file access, the system applies enhanced scrutiny only to critical files, reducing computational overhead while maintaining detection effectiveness.
Solution Approach 2:
The patent applies parameter changes by dynamically adjusting monitoring sensitivity and thresholds based on system state, user behavior patterns, and risk assessments. The system modifies detection parameters in real-time to balance security needs with computational efficiency, reducing false positives while maintaining detection accuracy.
3Difficulty of detecting and measuring
If traditional entropy-based detection is used, then some malware can be detected, but file-modifying malware that maintains entropy levels evades detection
Solution Approach 1:
The patent implements another dimension by moving detection from the entropy domain to the temporal and behavioral domain. Instead of analyzing file content entropy, the system monitors when files are accessed, by which processes, and in what sequences, detecting malware that preserves entropy through sophisticated modification techniques.
Solution Approach 2:
The patent introduces an intermediary layer of file access pattern analysis between the raw file system and the detection engine. This intermediary monitors and correlates file access events, process behaviors, and timing patterns to detect malware activity that traditional direct entropy analysis would miss.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A security agent implemented on a computing device is described herein. The security agent is configured to detect file-modifying malware by detecting that a process is traversing a directory of the memory of the computing device and detecting that the process is accessing files in the memory according to specified file access patterns. The security agent can also be configured to correlate actions of multiple processes that correspond to a specified file access pattern and detect that one or more of the multiple processes are malware by correlating their behavior.