Malware Detection via Local Remote Inventory Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious software and malware, such as rootkits, are disruptive and time-consuming, especially when assessing a host in an unpowered state, and there is a need for a more efficient approach to identify their presence without powering down the system.
Innovation Solution
A system and method that employs a local scanning agent and a remote scanning agent, along with a results correlation engine, to compare local and remote inventories of tasks and network services, identifying discrepancies to detect malicious software by conducting local and remote interrogations of a computer system without requiring it to be powered down.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing techniques query the host through local means in an unpowered state to detect rootkits and stealth install techniques, then detection capability is improved, but the process becomes highly disruptive and time consuming
Solution Approach 1:
The detection system is divided into two independent scanning agents: a local scanning agent that operates on the host system and a remote scanning agent that operates externally. Each agent performs specific detection functions and their results are correlated to identify hidden processes, allowing detection without powering down the host
Solution Approach 2:
A results correlation engine acts as an intermediary that receives and compares results from both the local scanning agent and remote scanning agent. This mediator correlates the two sets of results to identify discrepancies indicating hidden malicious processes, enabling detection without disrupting host operation
2Measurement precision
If existing techniques assess a host in an unpowered state to detect malicious software, then detection accuracy is improved, but system disruption increases
Solution Approach 1:
The system dynamically adapts its detection approach by running scanning agents in different states (local agent running on powered host, remote agent running externally) and correlating results. This dynamic methodology maintains detection accuracy while allowing the host to remain operational without powering down
Solution Approach 2:
The detection parameters are changed from requiring the host to be in an unpowered state to allowing the host to remain powered on. The system achieves this by changing the operational state of the scanning agents - the local agent operates on the powered host while the remote agent operates externally, and their correlated results provide accurate detection without disruption
3Measurement precision
If local and remote scanning agents are used to enumerate tasks and network services, then detection comprehensiveness is improved, but system complexity increases
Solution Approach 1:
The comprehensive detection function is segmented between two specialized scanning agents: the local scanning agent enumerates tasks and network services from within the host, while the remote scanning agent performs the same enumeration from an external perspective. This segmentation allows each agent to focus on specific detection aspects, improving comprehensiveness while managing complexity through division of labor
Solution Approach 2:
Both the local scanning agent and remote scanning agent perform the same core function of enumerating tasks and network services, but from different perspectives. This multi-functionality approach allows the system to use identical detection methodologies in both local and remote contexts, improving comprehensiveness while reducing complexity through methodological consistency
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system, method and program product for detecting presence of malicious software running on a computer system. The method includes locally querying the system to generate a local inventory of tasks and network services running on the system for detecting presence of malicious software running on the system and remotely querying the system from a remote system via a network to generate a remote inventory of tasks and network services running on the system for detecting presence of malicious software running on the system, where the local inventory enumerates ports in use on the system and where the remote inventory enumerates ports in use on the system. Further, the method includes collecting the local inventory and the remote inventory and comparing the local inventory with the remote inventory to identify any discrepancies between the local and the remote inventories for detecting presence of malicious software running on the system.