Malware Detection via Process Context Merging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods are ineffective in identifying multi-component malware with complex infection patterns, as they typically focus on single components and fail to detect malicious activity when multiple components combine to cause damage.
Innovation Solution
A malware detection system that monitors software object processes and threads, computes digital signatures, and analyzes events using behavior rules to identify malicious objects, merging contexts of related processes to detect complex behavior patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If common malware detection methods (signature or heuristic analysis) are used, then single component malware can be detected, but multi-component malware with complex infection patterns cannot be detected
Solution Approach 1:
The patent segments the malware detection process into distinct phases: individual component analysis and combined behavior analysis. Each malware component is first analyzed separately to establish baseline behavior, then the system segments and analyzes the interactions between components. This segmentation allows the system to detect both simple single-component malware and complex multi-component malware by examining how segmented components work together.
Solution Approach 2:
The patent merges individual component analyses with combined behavior analysis. After analyzing each malware component separately, the system merges these analyses to examine the collective behavior of multiple components. This merging enables detection of multi-component malware where the combination of components creates malicious functionality that isn't apparent when analyzing components in isolation.
2Measurement precision
If detailed monitoring of all process execution events is performed, then complex malware behavior can be detected, but system performance and resource usage deteriorate
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing digital signatures of software objects before detailed behavior monitoring begins. This preliminary signature computation allows the system to quickly identify and filter out trusted objects, avoiding the need for detailed event monitoring of benign processes. By performing this preliminary classification, the system reduces the volume of events requiring intensive analysis, thereby maintaining high detection precision while preserving system performance.
Solution Approach 2:
The patent implements partial monitoring by focusing detailed behavior analysis only on non-trusted objects and specific suspicious events rather than monitoring all process execution events uniformly. The system applies excessive action (detailed monitoring) selectively to high-risk targets identified through preliminary signature checking, while applying minimal monitoring to trusted objects. This selective approach achieves comprehensive security coverage without the performance penalty of universal detailed monitoring.
3Reliability
If digital signatures of all software objects are computed and verified, then trusted objects can be identified quickly, but processing time increases for large numbers of objects
Solution Approach 1:
The patent applies partial verification by computing digital signatures only for objects that require trust verification, rather than verifying every software object encountered. The system selectively applies signature verification to objects that are suspicious based on context, event patterns, or other risk indicators. This partial approach maintains high reliability for trust verification while significantly reducing the time loss associated with verifying large numbers of benign objects.
Data Source
AI summary
Disclosed are systems, methods and computer program products for detection of malware with complex infection patterns. The system provides enhanced protection against malware by identifying potentially harmful software objects, monitoring execution of various processes and threads of potentially harmful objects, compiling contexts of events of execution of the monitored processes and threads, and merging contexts of related processes and threads. Based on the analysis of the individual and merged object contexts using malware behavior rules, the system allows detection of malicious objects that have simple and complex behavior patterns.