Malware Detection via Device Attribute Risk Factors

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Computing devices face challenges in protecting themselves against malware due to the difficulty in accurately determining the risk of content based solely on file reputation, as existing methods do not adequately consider the attributes and usage patterns of the devices.

Innovation Solution

A method that involves determining a risk factor for a computing device by analyzing its attributes and activity, which is then used in conjunction with content indications to assess whether the content is malware, utilizing a risk determination system that collects and processes device attributes and activity data to provide a more accurate malware determination.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If file reputation checking is used to determine malware, then detection capability is provided, but detection accuracy is insufficient because device-specific factors are not considered

Engineering Contradiction:
Improvemalware detection accuracyVSAvoidsystem complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent applies local quality by transitioning from a uniform file reputation checking approach to a customized risk assessment that considers device-specific attributes. Each computing device receives tailored risk evaluations based on its unique characteristics (operating system, hardware configuration, software versions, network environment), allowing the system to adapt the detection sensitivity and methods to local device conditions, thereby improving detection accuracy without applying a one-size-fits-all approach

Inventive Principle:
Principle #3Local quality

Solution Approach 2:

The system performs preliminary actions by collecting and analyzing device attributes before conducting malware detection. The risk determination system gathers information about the computing device's operating system, hardware, software, and network environment in advance, then uses this pre-collected data to establish a baseline risk profile. This preliminary assessment enables more accurate and context-aware malware detection when actual content is evaluated

Inventive Principle:
Principle #10Preliminary action

2Measurement precision

If device attributes and activity data are collected and analyzed, then malware detection accuracy is improved, but data processing requirements and system complexity increase

Engineering Contradiction:
Improverisk assessment accuracyVSAvoiddata volume
Core Design Contradiction:
Measurement precisionVSQuantity of substance

Solution Approach 1:

The patent applies the taking out principle by extracting and isolating only the most relevant device attributes and activity data needed for risk assessment. Rather than processing all possible device information, the system selectively collects specific attributes (operating system details, hardware configuration, installed software, network environment) and activity patterns that have the highest correlation with malware risk. This extraction approach reduces the volume of data requiring processing while maintaining or improving assessment accuracy

Inventive Principle:
Principle #2Taking out (Extraction)

3Reliability

If device-specific risk factors are considered, then detection of unknown malware is improved, but computational resources required increase

Engineering Contradiction:
Improvedetection reliabilityVSAvoidcomputational energy
Core Design Contradiction:
ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system performs preliminary action by pre-calculating and storing risk profiles based on device attributes before actual malware detection occurs. The risk determination system analyzes device characteristics in advance and establishes baseline risk factors that can be reused for multiple detection operations. This pre-computation approach reduces the computational energy required during actual malware scanning, as the system leverages pre-established risk models rather than performing intensive real-time analysis for each detection event

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent applies feedback by using detection results and risk assessments to continuously refine and update the risk determination model. The system learns from actual malware detection outcomes and adjusts its risk factors accordingly, improving detection reliability over time. This feedback mechanism allows the system to become more efficient by focusing computational resources on the most relevant risk indicators identified through learned patterns, rather than uniformly processing all possible attributes

Inventive Principle:
Principle #23Feedback

Data Source

PatentEP3504659B1Computing device protection based on device attributes and device risk factor
Publication Date: 2021.03.10 MICROSOFT TECHNOLOGY LICENSING LLC
  • EP3504659B1 patent drawingFigure 1
  • EP3504659B1 patent drawingFigure 2
  • EP3504659B1 patent drawingFigure 3

AI summary

A computing device communicates a request to a risk determination system to determine whether particular content is malware. The content is oftentimes a file containing a program to be run, but can alternatively take other forms, and an indication of the content is provided to the risk determination system. Additional information describing attributes of the computing device is also provided to the risk determination system. These attributes can include for the computing device hardware specifications, operating system specifications, anonymized information, information describing anti-virus or other anti-malware program settings, information describing programs running on the computing device, and so forth. The risk determination system analyzes the information describing attributes and/or activity of the computing device to determine a risk factor of the content, and from the risk factor determines whether the content is malware for the computing device.