Malware Detection via Host Idle State Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malware systems are unable to effectively identify and differentiate command and control data channels when a user is not actively logged in to a host, making it difficult to detect potential malware activities due to obfuscation and impersonation techniques.
Innovation Solution
A system and method that determine whether a user is interactively logged in to a host, and if not, identifies data communications as potential malware by checking for screen-saver, keyboard-locked, or screen-powered-down states, thereby classifying command and control activities as unauthorized and malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current anti-malware systems monitor data communications to identify malware, then malware detection capability is improved, but false identification increases due to obfuscation and impersonation techniques used by malware attackers
Solution Approach 1:
The patent segments the identification process into multiple independent checks: (1) detecting command and control data channel communications, (2) determining user login status, (3) checking host state (screen-saver, keyboard-locked, screen-powered-down). By dividing the monitoring system into these separate functional modules, each checking a specific aspect, the system achieves more precise malware identification while reducing false positives, as malware typically exhibits multiple segmented characteristics simultaneously
Solution Approach 2:
The patent introduces user login status and host state as intermediary indicators between raw data communication and malware classification. These intermediaries serve as mediating evidence that helps distinguish malicious from benign communications - legitimate user activities typically occur when users are logged in and the host is in normal state, while malware operations often occur when users are not logged in and the host is in idle state
2Measurement precision
If anti-malware systems scan all data communications for malware detection, then detection coverage is improved, but system resources and time consumption increase
Solution Approach 1:
The patent applies partial action by not scanning all data communications with the full malware detection algorithm. Instead, it first performs a preliminary filter based on communication patterns (detecting command and control data channels), then applies the more resource-intensive user status and host state checks only to suspicious communications. This partial application of detection measures maintains high detection coverage while significantly reducing overall resource consumption
Solution Approach 2:
The patent performs preliminary identification of command and control data channel communications before conducting full malware analysis. By pre-filtering communications based on their characteristic patterns (such as IRC channel usage, periodic beaconing behavior), the system prepares a reduced set of suspicious communications for detailed analysis, thereby improving detection coverage for actual malware while reducing the computational burden on system resources
Data Source
AI summary
A system and associated computer program product for identifying malware. The system includes one or more processors, one or more computer-readable memories, one or more computer-readable storage devices, and program instructions stored on the one or more storage devices for execution by the one or more processors via the one or more memories. The program instructions include program instructions to receive a data communication simulating manual interaction between a user of the computer and the computer. The program instructions may determine that no user was interactively logged on to the computer approximately at a time the data communication was received by the computer, and in response, classify the data communication as a potential malware communication.