Malware Detection via Communication Pattern Deviation Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The widespread infiltration of malware into computers and mobile devices necessitates an effective automatic detection and removal system that can differentiate between normal communication patterns and those indicative of malware presence.
Innovation Solution
An anti-malware system comprising a database storing application-specific communication footprints and a server that calculates reference and current communication patterns, providing alerts when deviations occur, along with monitors and databases for circuit-switched and data-switched communication patterns to detect and confirm malware presence, and proactively sends triggering messages to elicit malicious patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware detection methods are used, then malware can be detected, but false positives occur due to inability to differentiate between normal and malicious communication patterns
Solution Approach 1:
The system transforms malware detection from static signature matching to dynamic parameter analysis by monitoring communication patterns including message timing, frequency, destination, and content characteristics. This parameter-based approach enables differentiation between normal and malicious communications based on behavioral metrics rather than fixed patterns.
Solution Approach 2:
The system implements feedback mechanisms where detected communication patterns are continuously analyzed and compared against established baselines. When deviations are detected, the system generates alerts and can trigger remediation actions, creating a closed-loop detection system that adapts to new threats while maintaining reliability through continuous validation.
2Reliability
If comprehensive communication monitoring is implemented, then malware detection capability is improved, but system complexity increases
Solution Approach 1:
The system segments the malware detection function into distinct modular components: communication interceptors that capture data, pattern analysis engines that process communications, baseline establishment modules that create reference profiles, and alert generation systems that respond to anomalies. This segmentation reduces overall system complexity by allowing each component to be developed, tested, and maintained independently.
Solution Approach 2:
The system introduces intermediary elements including communication proxies that mediate between applications and networks, and analysis intermediaries that buffer and process communication data before final evaluation. These intermediaries simplify the architecture by providing standardized interfaces and abstraction layers between different system components.
3Speed
If real-time communication pattern analysis is performed, then malware can be detected promptly, but computational resources are consumed
Solution Approach 1:
The system applies partial action by monitoring only the most critical communication parameters and analyzing patterns selectively rather than processing every communication event in full detail. This approach maintains detection speed by focusing computational resources on high-risk indicators while reducing overall resource consumption through targeted analysis.
Solution Approach 2:
The system implements periodic action by establishing baseline communication patterns over time periods and comparing current communications against these baselines at scheduled intervals. This periodic comparison approach enables timely malware detection while managing computational load by not requiring continuous full-analysis of every communication event.
Data Source
AI summary
An anti-malware system including at least one database, remote from a plurality of computers to be protected, which stores identification of computer applications resident on the computers to be protected and an application-specific communications footprint for the computer applications, and at least one server, remote from the plurality of computers to be protected, and being operative to calculate a reference computer-specific communications composite pattern based on multiple application-specific communications footprints for applications installed on the computers to be protected, calculate a current computer-specific communications composite pattern based on actual communications of at least one the plurality of computers to be protected, and provide an alert when the current computer-specific communications composite pattern of the at least one of the plurality of computers to be protected differs from the reference computer-specific communications composite pattern of the at least one of the plurality of computers to be protected.