Malware Detection System Using Staging Server Queues

Solution Overview

Problem

Traditional network and client-based security tools fail to effectively address sophisticated, socially engineered, and targeted malware attacks, particularly zero-day exploits and polymorphic malcode, which often go undetected in legitimate-looking emails and documents, eroding the security perimeter of high-value networks.

Innovation Solution

Implementing a malware detection system that uses multiple mail queues to manage message flows, allowing for significant delays in email delivery, with automatic release mechanisms and fail-safes, enabling advanced malware analysis and non-real-time detection, utilizing dual command and control methods via scripts and SSH/C2 for secure operation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If traditional security tools perform minimally invasive analysis, then email delivery speed is maintained, but malware detection capability deteriorates

Engineering Contradiction:

Improveemail delivery speedVSAvoidmalware detection capability

Core Design Contradiction:

SpeedVSReliability

Solution Approach 1:

The system segments email processing into multiple queues (inbound, timeout, jail, decomposition, outgoing) with different processing depths. Critical emails go through full analysis in the decomposition queue while less critical emails can use faster paths, allowing the system to maintain both speed and detection capability simultaneously

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary analysis actions by delaying suspicious emails in the timeout queue before final delivery. This allows security tools to conduct thorough malware analysis in advance without blocking all email traffic, thereby improving detection capability while maintaining overall delivery speed

Inventive Principle:

Principle #10Preliminary action

2Measurement precision

If security tools work off a copy of the message in non-real-time, then analysis thoroughness is improved, but response time to threats worsens

Engineering Contradiction:

Improveanalysis thoroughnessVSAvoidresponse time to threats

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary analysis actions by delaying suspicious emails in the timeout queue before final delivery. This allows security tools to conduct thorough malware analysis in advance without blocking all email traffic, thereby improving detection capability while maintaining overall delivery speed

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system dynamically adjusts the level of analysis based on email characteristics and queue status. Emails can be routed to different queues (inbound, timeout, jail, decomposition) depending on their suspiciousness level, allowing the system to perform thorough analysis only when and where needed, thus balancing analysis thoroughness with response time

Inventive Principle:

Principle #15Dynamics

3Reliability

If intrusion prevention systems interrupt email delivery for analysis, then malware detection capability is improved, but productivity of email delivery deteriorates

Engineering Contradiction:

Improvemalware detection capabilityVSAvoidemail delivery throughput

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system segments email processing into multiple queues (inbound, timeout, jail, decomposition, outgoing) with different processing depths. Critical emails go through full analysis in the decomposition queue while less critical emails can use faster paths, allowing the system to maintain both speed and detection capability simultaneously

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system applies partial analysis action by providing different levels of inspection based on email characteristics. Not all emails undergo the same level of analysis, allowing the system to maintain high delivery throughput while still detecting malware through targeted analysis of suspicious messages

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS8914882B2Intrusion prevention system (IPS) mode for a malware detection system

Publication Date: 2014.12.16 EVERFOX HOLDINGS LLC

AI summary

Intrusion prevention system (IPS) mode is provided for a malware detection system. At least one staging server is provided for intercepting an incoming electronic message, making a copy of the intercepted incoming electronic message, and holding the intercepted incoming electronic message until an analysis of the copy of the intercepted incoming electronic message has been completed or until a timeout threshold has been exceeded. A malware detection system is coupled to the at least one staging server. The at least one malware detection system includes at least one decomposition server for receiving the copy of the intercepted incoming electronic message and processing the copy of the intercepted incoming electronic message to detect malware. Multiple mail queues, e.g., incoming, timeout, jail, decomposition, and outgoing, are used to manage message flows and delay messages while malware analysis is performed.