Malware Detection via Device Attribute Risk Factors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing devices face challenges in protecting themselves against malware due to the difficulty in accurately determining the risk of content based solely on file reputation, as existing methods do not adequately consider the attributes and usage patterns of the devices.
Innovation Solution
A method that involves determining a risk factor for a computing device by analyzing its attributes and activity, which is then used in conjunction with content indications to assess whether the content is malware, utilizing a risk determination system that collects and processes device attributes and activity data to provide a more accurate malware determination.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If file reputation checking is used to determine malware, then detection capability is provided, but detection accuracy is insufficient because device-specific factors are not considered
Solution Approach 1:
The patent applies local quality by transitioning from a uniform file reputation checking approach to a customized risk assessment that considers device-specific attributes. Each computing device receives tailored risk evaluations based on its unique characteristics (operating system, hardware configuration, software versions, network environment), allowing the system to adapt the detection sensitivity and methods to local device conditions, thereby improving detection accuracy without applying a one-size-fits-all approach
Solution Approach 2:
The system performs preliminary actions by collecting and analyzing device attributes before conducting malware detection. The risk determination system gathers information about the computing device's operating system, hardware, software, and network environment in advance, then uses this pre-collected data to establish a baseline risk profile. This preliminary assessment enables more accurate and context-aware malware detection when actual content is evaluated
2Measurement precision
If device attributes and activity data are collected and analyzed, then malware detection accuracy is improved, but data processing requirements and system complexity increase
Solution Approach 1:
The patent applies the taking out principle by extracting and isolating only the most relevant device attributes and activity data needed for risk assessment. Rather than processing all possible device information, the system selectively collects specific attributes (operating system details, hardware configuration, installed software, network environment) and activity patterns that have the highest correlation with malware risk. This extraction approach reduces the volume of data requiring processing while maintaining or improving assessment accuracy
3Reliability
If device-specific risk factors are considered, then detection of unknown malware is improved, but computational resources required increase
Solution Approach 1:
The system performs preliminary action by pre-calculating and storing risk profiles based on device attributes before actual malware detection occurs. The risk determination system analyzes device characteristics in advance and establishes baseline risk factors that can be reused for multiple detection operations. This pre-computation approach reduces the computational energy required during actual malware scanning, as the system leverages pre-established risk models rather than performing intensive real-time analysis for each detection event
Solution Approach 2:
The patent applies feedback by using detection results and risk assessments to continuously refine and update the risk determination model. The system learns from actual malware detection outcomes and adjusts its risk factors accordingly, improving detection reliability over time. This feedback mechanism allows the system to become more efficient by focusing computational resources on the most relevant risk indicators identified through learned patterns, rather than uniformly processing all possible attributes
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computing device communicates a request to a risk determination system to determine whether particular content is malware. The content is oftentimes a file containing a program to be run, but can alternatively take other forms, and an indication of the content is provided to the risk determination system. Additional information describing attributes of the computing device is also provided to the risk determination system. These attributes can include for the computing device hardware specifications, operating system specifications, anonymized information, information describing anti-virus or other anti-malware program settings, information describing programs running on the computing device, and so forth. The risk determination system analyzes the information describing attributes and/or activity of the computing device to determine a risk factor of the content, and from the risk factor determines whether the content is malware for the computing device.