Malware Detection via Input-Output Statistical Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Legacy computing systems are vulnerable to malware infections, which can masquerade as legitimate users and expose sensitive information, making it difficult to protect user privacy and security, especially when updates and upgrades introduce risks of infection.

Innovation Solution

Implementing a dual environment system with a trusted environment that communicates with the legacy environment to detect malware by analyzing statistical relations between input and output data, using computational, simulated, or AI techniques to determine the presence of malware without relying on exact program verification or additional data sources.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If classical AI techniques analyze big data to identify malware by anomaly detection in global input/output data sets, then the detection coverage is increased, but the complexity and false alarm rate increase due to noise from unrelated measures

Engineering Contradiction:

Improvemalware detection accuracyVSAvoiddetection process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the malware detection process by focusing on individual program evaluations rather than analyzing global data sets. Each program is tested independently by evaluating its input data against its processed output data, which simplifies the detection process and reduces complexity while maintaining high accuracy.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent extracts the essential detection function from complex global analysis by identifying that the necessary and sufficient condition for malware detection is the evaluation of input data to output data relationships for each individual program. This extraction eliminates noise from unrelated measures and focuses only on relevant program behavior.

Inventive Principle:

Principle #2Taking out (Extraction)

2Measurement precision

If program verification relies on exact match between input and output data, then the verification precision is improved, but the approach cannot effectively detect statistical anomalies and malware variations

Engineering Contradiction:

Improveprogram verification precisionVSAvoiddetection adaptability to malware variations

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent changes the verification parameter from exact match to statistical relationship evaluation. Instead of requiring precise exact matches between input and output data, the system evaluates statistical relationships to detect anomalies and malware variations, providing both precision and adaptability.

Inventive Principle:

Principle #35Parameter changes

3Productivity

If legacy computing systems operate without trusted environments, then the system simplicity and performance are maintained, but the security and protection from malware interference are compromised

Engineering Contradiction:

Improvecomputing system performanceVSAvoidmalware infection risk

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a trusted environment as an intermediary between the legacy computing system and the malware detection function. This trusted environment receives input and output data from legacy programs, evaluates their statistical relationships, and provides malware detection without interfering with the legacy system's normal operation, thus maintaining performance while adding security.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS20200322364A1Program verification and malware detection

Publication Date: 2020.10.08 BARKAN MORDECAI

AI summary

Software programs are updated and upgraded regularly. This is a cause for infection by malware (or a faulty program). By attaining the statistical relation between the input data to the program and the output data from the program the presence of malware may be detected with high fidelity. The base for this approach is the fact the necessary and sufficient conditions to determine the working of a program is evaluation of input against output.