Malware Detection via System Call Pattern Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for internet security, particularly in web browsers, fail to effectively prevent malware installation and protect user data from malicious browser extensions, often relying on time-consuming file scanning and assuming the browser is secure, which can lead to system compromise before threats are detected.
Innovation Solution
A security system that monitors system calls and analyzes code patterns to detect and prevent malware installation by comparing examined process code against predefined patterns, including a 'black list' of known malware, allowing real-time detection and prevention of malicious code execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If protective tools scan the content of executable files to classify them as malicious or benign, then detection accuracy is improved, but the scanning process takes more time than required for a malicious file to install itself
Solution Approach 1:
The patent applies preliminary action by monitoring system calls and analyzing code patterns during the malware installation process itself, rather than scanning the complete file beforehand. The security system intercepts system calls made by the executable file during installation and analyzes the call sites in real-time, enabling detection before the malicious file completes its installation and causes damage.
2Reliability
If existing security solutions enhance online authentications, then user data protection is improved, but they assume the web browser is secure and do not protect against malware installation
Solution Approach 1:
The patent introduces an intermediary security system that operates between the executable file and the operating system. By monitoring system calls at the OS level, the security application can detect malware installation attempts regardless of whether the malware targets the browser directly. This intermediary approach expands protection scope from browser-specific security to system-wide malware prevention.
Data Source
AI summary
System and method for determining, by a security application, whether an examined software code is a malware, according to which the system detects whenever the examined process code performs system calls and further detects a call site. Pieces of code in the surrounding area of the site and/or in branches related to the site are analyzed and the properties of the analyzed pieces of code are compared with a predefined software code patterns, for determining whether the examined process code corresponds to one of the predefined software code patterns. Then the examined process code is classified according to the comparison results.