Dynamic Malware Detection Tuning via Configuration Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection systems face high rates of false positives and false negatives due to reliance on hard-coded rules, leading to slow updates and inadequate response to evolving malware threats, particularly Advanced Persistent Threats (APT) attacks.
Innovation Solution
A fully parameterized malware detection system that utilizes a configuration file to dynamically adjust parameters and operation rules for detection engines, enabling real-time tuning and customization to enhance detection accuracy and reduce false positives and false negatives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hard-coded rules are used to control detection operations, then system stability is maintained, but detection accuracy deteriorates due to high false positive and false negative rates
Solution Approach 1:
The patent implements dynamic rule generation that adapts to evolving malware threats in real-time, replacing static hard-coded rules with dynamically created detection rules based on observed malware behavior patterns
Solution Approach 2:
The system changes detection parameters dynamically by generating new rules based on observed malware characteristics, allowing the detection system to adapt its parameters (such as detection thresholds and rule priorities) based on current threat landscapes
2Measurement precision
If new software versions are released to address malware threats, then detection accuracy improves, but response time deteriorates due to 4-6 month development and testing cycles
Solution Approach 1:
The system performs self-updating by automatically generating new detection rules based on observed malware behavior, eliminating the need for manual rule creation and extensive testing cycles that characterize traditional malware detection system updates
Solution Approach 2:
The system prepares detection rules in advance by continuously monitoring and learning from malware behavior patterns, so that when new threats emerge, pre-adapted rules are already available for immediate deployment
3Device complexity
If generic malware detection rules are used, then system complexity is reduced, but adaptability deteriorates due to inability to target specific customer threats
Solution Approach 1:
The patent implements local quality by customizing detection rules for specific customers and their unique threat landscapes, allowing different parts of the detection system to have different rule sets tailored to local security requirements and observed threats
Solution Approach 2:
The system segments the detection rule set into customer-specific portions and generic portions, allowing each customer to have customized rules for their specific threats while sharing common detection capabilities
Data Source
AI summary
According to one embodiment, an non-transitory storage medium is configured to store a plurality of engines, which operate to conduct an analysis of a received object to determine if the object is associated with a malicious attack. The plurality of engines includes a first engine and a second engine. The first engine is configured to conduct a first analysis of the received object for anomalous behaviors including anomalous actions or omissions during virtual processing of the object that indicate the received object is malicious. The second engine is configured to conduct a second analysis corresponding to a classification of the object as being associated with a malicious attack. The analysis schemes conducted by the first engine and the second engine may be altered via configuration files, which adjusts (i) parameter value(s) or (ii) operation rules(s) to alter the analysis conducted by the first engine and/or second engine.