Malware Detection via Event Loop Distribution Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity of malware detection due to obfuscation and the resource-intensive nature of identifying malicious behavior in computer systems poses a significant challenge, as existing methods often require disassembly or signature-based detection, which can be evaded by sophisticated threats.
Innovation Solution
A system that monitors and analyzes event sequences to detect repeated patterns of operations, forming 'loops', using histograms and distribution analysis to identify potentially malicious activities without requiring code inspection, and employs a security agent to communicate with a cloud service for further analysis and mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection or code disassembly is used to identify malware, then detection capability is improved, but the system becomes vulnerable to obfuscation and disguise techniques
Solution Approach 1:
The patent replaces traditional signature-based mechanical detection with behavior-based monitoring. Instead of analyzing static code signatures that can be obfuscated, the system monitors dynamic event sequences (API calls, registry changes, file operations) to detect malware behavior patterns, making detection resilient to obfuscation and disguise techniques.
Solution Approach 2:
The system changes the detection parameters from static code characteristics (signatures) to dynamic behavioral parameters (event sequence patterns). By monitoring changes in system state over time and identifying loops in event sequences, the system can detect malware regardless of its obfuscation level, as behavior patterns remain consistent even when code is disguised.
2Measurement precision
If comprehensive malware analysis is performed to improve detection accuracy, then detection precision is improved, but resource consumption and analysis time increase significantly
Solution Approach 1:
The patent extracts only the essential behavioral information from comprehensive system monitoring. Instead of analyzing all code and system operations in detail, the system extracts and monitors specific event sequences (API calls, registry modifications, file operations) that are characteristic of malware behavior, achieving accurate detection with reduced resource consumption.
Solution Approach 2:
The system performs partial monitoring of critical system events rather than comprehensive analysis of all system operations. By focusing on a targeted set of monitored events (process creation, registry changes, file operations) and identifying loops within these events, the system achieves sufficient detection accuracy without the resource intensity of full code disassembly or comprehensive system analysis.
3Ease of operation
If existing detection methods are used to maintain simplicity, then ease of operation is preserved, but false positives and false negatives increase
Solution Approach 1:
The system incorporates feedback mechanisms where monitored event sequences are compared against known malware behavior patterns and stored in data structures for continuous reference. This feedback loop enables the system to learn from observed behaviors and improve detection accuracy over time, reducing false positives and false negatives while maintaining operational simplicity through automated pattern matching.
Data Source
AI summary
Example techniques locate or identify malware based on events from or at monitored computing devices. A control unit can detect a sequence of events of various types. The control unit can locate a loop within the sequence of events based at least in part on relative frequencies of the event types. The control unit can determine a distribution of event types of the events within the loop, and determining that software running the sequence is associated with malware based at least in part on the distribution of event types within the loop. In some examples, the control unit can locate a point of commonality among a plurality of stack traces associated with respective events within the loop. The control unit can determine a malware module comprising the point of commonality.