Malware Detection via Device Profile Deviation Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods often rely on signature-based or heuristic approaches, which can be inefficient and resource-intensive, and may not effectively detect anomalies in real-time network activity, leading to potential delays in identifying and addressing malware or fraud threats.
Innovation Solution
A system comprising a monitoring program that reviews network data, creates a device profile of typical operations, and generates alerts for irregularities, using multiple data sources such as network flow traffic statistics, proxy logs, and email headers to detect deviations from normal behavior, thereby identifying potential malware or fraud.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based or heuristic malware detection methods are used, then malware detection capability is provided, but system operation speed is considerably slowed down and resource efficiency decreases
Solution Approach 1:
The patent introduces a scanner as an intermediary component that operates between the malware and the operating system. The scanner intercepts file access operations, analyzes them separately, and only blocks suspicious operations without affecting the overall system performance. This mediator approach allows thorough malware detection while maintaining system operation speed.
Solution Approach 2:
The malware detection function is segmented from the main operating system operations. The scanner operates as a separate module that hooks into specific file access operations rather than continuously monitoring all system activities. This segmentation allows detection capability to be applied only when needed, preserving overall system productivity.
2Reliability
If real-time network data scanning is performed to block malware installation, then protection against malware installation is provided, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary scanning of incoming network data before malware can be installed. The scanner analyzes network data in advance, identifying potential threats before they execute or install on the system. This preliminary action prevents malware installation without requiring continuous real-time monitoring during critical operations.
3Reliability
If multiple detection sources are used to detect malware attacks, then detection reliability is improved, but system complexity increases
Solution Approach 1:
The patent combines multiple detection sources (signature-based detection, heuristic analysis, and behavioral monitoring) into a unified scanning system. Rather than operating as separate complex systems, these detection methods are merged into a single scanner that coordinates their operations, reducing overall system complexity while maintaining high detection reliability.
Data Source
AI summary
A system and method for the detection of irregularities, such as fraud or malware, running on a device, is disclosed. An example method includes receiving new ones of data items indicative of the device's current operation; determining whether the new ones of data items deviate from the device's typical operation by comparing the new ones of data items to a profile relating to the typical operation of the device, wherein the deviating includes either using an infrequently used one of incoming ports and outgoing ports or continually accessing a new website. The example method can further include based on the determining: updating the device baseline profile to create an updated device baseline profile with the new ones of data items if the new ones of data items do not deviate from the typical operation of the device; and generating an alert if the new ones of data items do deviate from the typical operation of the device.