Malware Exception List Automation via Client Feedback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current behavior monitoring systems for malware detection face high CPU usage due to the need to continuously monitor numerous processes, with updating exception lists being resource-intensive and prone to errors, making it inefficient to manage and maintain.
Innovation Solution
A method for automatically updating exception lists by collecting client process reports, analyzing CPU usage, and temporarily placing high-CPU processes on an exception list on the client device, with feedback to a server for potential inclusion in a universal exception list, reducing CPU load and improving efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavior monitoring checks all processes one by one to detect malware, then detection accuracy is improved, but CPU usage increases significantly
Solution Approach 1:
The monitoring system segments processes into two categories: those on the exception list (white-listed) and those not on the list. Processes on the exception list are excluded from detailed behavior monitoring, while other processes continue to be monitored. This segmentation reduces the volume of processes requiring intensive CPU analysis while maintaining detection accuracy for non-exempted processes.
Solution Approach 2:
The patent extracts known safe processes from the general monitoring pool and places them on an exception list. These extracted processes are removed from the monitoring workflow, eliminating the need to analyze their behavior in detail. This extraction reduces CPU overhead by focusing monitoring resources only on processes that are not already identified as safe.
2Reliability
If the exception list is updated manually by service provider support teams, then process safety is ensured, but updating time and labor resources increase
Solution Approach 1:
The system implements a feedback mechanism where client devices automatically report process behavior data to the service provider. This feedback loop enables the service provider to identify patterns and update the exception list based on aggregated real-world data from multiple clients, reducing manual analysis time while maintaining accuracy through collective intelligence.
Solution Approach 2:
Client devices automatically generate reports about their local exception lists and process behaviors. This self-service capability allows the system to collect data without manual intervention, enabling faster aggregation and analysis of process safety information across the client base.
3Extent of automation
If customers wait for periodic exception list updates from service providers, then centralized control is maintained, but CPU performance issues are delayed
Solution Approach 1:
The system performs preliminary actions by having client devices automatically collect and report process data in real-time. This preliminary data gathering enables the service provider to prepare exception list updates more quickly, reducing the delay between when a performance issue is identified and when the update is distributed to clients.
Solution Approach 2:
The feedback mechanism operates continuously, with client devices constantly reporting process behavior data. This continuous action ensures that the service provider receives ongoing information about process safety and performance issues, enabling faster update cycles compared to periodic manual collection methods.
4Measurement precision
If comprehensive process data collection is implemented for exception list updates, then update accuracy is improved, but network and computational resources increase
Solution Approach 1:
The system extracts only the essential and most relevant process data needed for exception list evaluation, rather than transmitting all possible process information. This selective extraction reduces data transmission volume while maintaining sufficient accuracy for determining whether processes should be added to the exception list.
Data Source
AI summary
Generating an exception list by a service provider for use in behavior monitoring programs for malware detection is described. A feedback server controlled by a malware prevention service provider receives client process reports from client devices owned by the service provider's customers and others using the provider's behavior monitoring software. The process reports contain data on processes that were evaluated (on the client device) as being processes that require a significant amount of CPU resources (i.e., above a certain threshold) to monitor and that have previously executed on the client device and were considered safe or non-harmful to the device. The feedback server receives the process reports and creates a statistics summary report, which is used by the service provider in evaluating whether to include the processes in the provider's official exception list which is distributed to its customers for use in their behavior monitoring programs. While creating the process reports on the client devices, the devices are able to temporarily address issues caused by processes taking up too much of the behavior monitor's CPU usage by including the process on exception list only for that client. The final decision as to whether the process will be on the final or official exception list is made by the service provider.