Malware Detection Selective Rule Application
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems face inefficiencies and increased false positives due to the large number of rules required to detect various types of malware, leading to high resource consumption and decreased effectiveness.
Innovation Solution
Implementing a selective rule application method using artificial intelligence and machine learning to apply a subset of relevant rules to files based on their characteristics, combined with a machine learning model to analyze outcomes and reduce false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all rules are applied to all files for malware detection, then detection coverage is improved, but processing time and resource consumption increase
Solution Approach 1:
The patent segments the rule application process by dividing rules into different categories (e.g., fast rules and slow rules) and applying them in stages. Quick detection rules are applied first to rapidly identify obviously malicious files, while more comprehensive but time-consuming rules are applied only when necessary, thus maintaining detection coverage while reducing overall processing time.
Solution Approach 2:
The patent applies partial action by not executing all detection rules for every file. Instead, it selectively applies a subset of rules based on file characteristics, initial scan results, and risk assessments. This partial application of rules maintains adequate detection coverage for most files while significantly reducing the time and resources spent on files that are clearly benign or have already been identified as malicious.
2Reliability
If the number of detection rules is increased to detect more malware varieties, then detection capability is improved, but false positives increase
Solution Approach 1:
The patent applies local quality by assigning different weights and confidence levels to different detection rules based on their historical accuracy and relevance to specific file types. Rules with higher reliability are given more weight in the final determination, while rules prone to false positives are either downweighted or require additional confirmation. This allows the system to maintain high detection capability while reducing false positives through differential treatment of individual rules.
Solution Approach 2:
The patent implements feedback mechanisms where detection results are continuously analyzed and used to adjust rule application strategies. When false positives are detected, the system learns from these errors and adjusts which rules are applied to similar files in the future, or modifies the thresholds for rule triggering. This feedback loop enables the system to maintain high detection capability while progressively reducing false positive rates through experience.
3Reliability
If comprehensive rule application is used to ensure accurate malware detection, then detection accuracy is improved, but system resource consumption increases
Solution Approach 1:
The patent applies dynamics by making the rule application process adaptive rather than static. The system dynamically adjusts which rules are applied based on real-time factors such as file characteristics, current system resource availability, and historical detection patterns. This dynamic approach ensures that sufficient computational resources are allocated to achieve accurate detection when needed, while conserving resources during periods of low risk or when scanning large volumes of obviously benign files.
4Reliability
If all files are scanned with multiple rules, then malware detection thoroughness is improved, but maintenance cost increases
Solution Approach 1:
The patent applies parameter changes by adjusting the detection threshold and rule application parameters based on operational context. Different scanning modes (e.g., quick scan vs. full scan) use different parameter settings, allowing the system to balance thoroughness with resource consumption. This flexibility enables the system to maintain high detection thoroughness when needed while reducing maintenance costs through optimized parameter selection for routine operations.
Data Source
AI summary
An information handling system may receive a plurality of rules and a file for malware testing. The information handling system may apply two or more of the plurality of rules to the received file to determine a plurality of outcomes of application of the rules to the file. The information handling system may determine whether to classify the received file as malware or not malware by applying a machine learning model to the plurality of outcomes.