Malware Event Filtering and File Rollback Mechanism
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods are inefficient and may result in repeated attacks on victims, as they lack effective filtering and remediation mechanisms to quickly identify and counter malicious software.
Innovation Solution
A method that filters events using an exclusions list, updates the list based on non-malware events, saves original files before editing, and restores files if ransomware is detected, thereby enhancing detection and remediation efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all events are logged and monitored for malware detection, then detection completeness is improved, but system performance and storage efficiency deteriorate
Solution Approach 1:
The patent segments event monitoring into two streams: excluded events (normal operations) are filtered out and not logged, while non-excluded events (potential malware) are logged and analyzed. This segmentation allows the system to maintain high detection completeness for suspicious events while avoiding the performance penalty of logging all events.
Solution Approach 2:
The patent extracts and removes excluded events from the monitoring pipeline before they consume system resources. By taking out known-safe events through the exclusions list, the system eliminates unnecessary logging overhead while preserving complete monitoring of potentially malicious events.
2Reliability
If file copies are saved for all processes, then file restoration capability is improved, but storage space consumption increases
Solution Approach 1:
The patent applies local quality by making file copying selective rather than universal. Files are copied and stored only for processes that are not in the exclusions list, meaning only potentially malicious processes trigger backup operations. This localized approach provides restoration capability exactly where needed while avoiding unnecessary storage consumption for normal processes.
Solution Approach 2:
The patent performs preliminary file copying for non-excluded processes before malware can corrupt the original files. By proactively saving copies of files touched by suspicious processes, the system ensures restoration capability is already in place before damage occurs, rather than attempting recovery after corruption.
3Productivity
If event filtering using exclusions list is implemented, then processing efficiency is improved, but complexity of event management increases
Solution Approach 1:
The patent implements feedback by continuously updating the exclusions list based on analysis of logged events. When events are analyzed and determined to be from benign processes, those event types are added to the exclusions list, creating a self-improving filter that becomes more efficient over time while maintaining manageable complexity through automated learning.
Data Source
AI summary
An anti-malware application detects and remediates malware. The anti-malware application detects an event associated with a process and determines if the event matches an entry in an exclusions list. If the event is absent from the exclusions list, the anti-malware application monitors the operation of the process, logs the event data in an event log, and sends the event to a server to determine whether the process corresponds to malware. The anti-malware application updates the exclusions list based on the logged event if the process does not correspond to malware. The anti-malware application restores a file edited by the process to the saved copy of the original file prior to the file being edited by the process if the process corresponds to malware.