Malware Detection via Operating Parameter Deviations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems face inefficiencies as they rely on scanning all files for known signatures, leading to increased time and resource usage, especially in larger computer systems, which can hinder system performance.
Innovation Solution
Monitoring operating parameters of a computing system to identify deviations from baseline values, matching these deviations with predetermined malware definitions to initiate targeted scans, thereby reducing resource usage and scan time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional malware scanning methods are used that compare all files to known virus signatures, then malware detection capability is maintained, but system scan time and resource consumption increase substantially
Solution Approach 1:
The system performs preliminary monitoring of operating parameters to establish baseline values before conducting full malware scans. By pre-identifying deviations from normal operating conditions, the system prepares targeted scan lists in advance, avoiding the need to scan all files uniformly. This preliminary action significantly reduces scan time while maintaining detection reliability.
Solution Approach 2:
Instead of performing exhaustive scans of all files, the system applies partial scanning by focusing only on files associated with processes showing abnormal operating parameter deviations. This selective approach performs only the necessary scanning portion, reducing overall scan time and resource consumption while maintaining adequate malware detection capability.
2Reliability
If comprehensive file scanning is performed to ensure thorough malware detection, then detection accuracy is improved, but system resource consumption increases
Solution Approach 1:
The system applies different scanning intensities to different files based on local conditions. Files associated with processes showing abnormal operating parameter deviations receive thorough scanning, while files from normal processes receive minimal or no scanning. This localized quality approach maintains detection accuracy for suspicious files while reducing overall resource consumption.
Solution Approach 2:
The system changes the scanning parameters dynamically based on operating parameter deviations. When deviations are detected, the system adjusts scanning intensity and scope for related files; when no deviations occur, scanning parameters are reduced. This parameter adjustment maintains detection accuracy when needed while conserving resources during normal operation.
3Reliability
If frequent malware scans are conducted to maintain system security, then malware detection reliability is improved, but system performance and productivity deteriorate
Solution Approach 1:
The system implements periodic monitoring of operating parameters at intervals rather than continuous scanning. By periodically checking for deviations from baseline behavior and only initiating scans when anomalies are detected, the system maintains security oversight while minimizing performance impact during normal operation.
Solution Approach 2:
The system uses its own operating parameters as indicators of potential malware presence. By monitoring its own performance metrics and automatically triggering scans only when abnormal patterns are detected, the system maintains security without requiring external intervention or frequent scheduled scans that would impact productivity.
Data Source
AI summary
A method is provided for detecting malware, such as a virus or spyware. The method looks for deviations expected operating parameters instead of focusing solely on conventional malware signatures. The method includes monitoring current operating parameters for a computing system running one or more application, obtaining baseline operating parameters for the computing system running the one or more application in the absence of malware, identifying a deviation between the current operating parameters and the baseline operating parameters, and determining whether the identified deviation matches a deviation associated with a predetermined malware definition.