Malware Detection System Using True-Root-Path Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods, particularly behavioral detection, suffer from high false-positive rates and inefficiencies in identifying ransomware threats, especially in distinguishing between genuine and malicious file modification patterns.
Innovation Solution
A malware detection system that incorporates a behavioral detection unit, file-traversal-information detection unit, true-root-path detection unit, and a neural-network-based classifier to analyze process events and file operations, identifying patterns indicative of ransomware through true-root-path analysis and machine learning classification, while filtering out unnecessary events and employing response engines for effective threat mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavioral detection techniques are used to evaluate process actions for suspicious behavior, then ransomware detection capability is improved, but false-positive rate increases and productivity is reduced
Solution Approach 1:
The patent segments the detection process into multiple specialized units: a behavioral detection unit for evaluating process actions, a file-traversal-information detection unit for analyzing file access patterns, and a true-root-path detection unit for identifying genuine file locations. This segmentation allows each unit to specialize in specific detection aspects, improving overall accuracy while reducing false positives through coordinated analysis.
Solution Approach 2:
The patent introduces an event reader as an intermediary component that collects and filters process events before they reach the detection units. This intermediary layer pre-processes the data, removing unnecessary events and organizing information in a way that reduces the computational burden on detection units and minimizes false positives by focusing only on relevant suspicious activities.
2Reliability
If traffic-based detection looks for communication patterns common to malware, then recent malware strains can be detected, but detection speed decreases and efficiency is reduced
Solution Approach 1:
The patent implements preliminary action by having the event reader continuously monitor and collect process events in advance, organizing them into structured formats before detection is needed. The system pre-processes file traversal information and maintains ready-to-analyze data structures, so when detection is required, the analysis can proceed rapidly without the overhead of real-time data collection and organization.
3Measurement precision
If signature-based detection requires malware with known signature, then detection accuracy for known malware is improved, but effectiveness against recent or targeted attacks is lost
Solution Approach 1:
The patent employs dynamic detection methods that adapt to different malware types. The behavioral detection unit evaluates process actions in real-time, the file-traversal-information detection unit analyzes access patterns, and the true-root-path detection unit identifies genuine file locations. These dynamic analyses allow the system to detect both known malware through pattern recognition and new malware through behavioral anomaly detection, providing versatility across different threat types.
Data Source
AI summary
Described are methods and systems that prevent malicious software from deleting shadow copies of computer files that might be required to restore user data in the event of a ransomware attack. A user layer includes a volume snapshot service that makes shadow copies and includes a hook to intercept delete requests. A kernel layer includes a filter to disallow shadow-copy deletion requests directed from the user layer to the operating-system.