Malware Intrusion Assessment Using Multi-Scan Severity Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-virus tools are ineffective in detecting and remediating file-less forms of malware, as they do not leave typical traces of their existence.
Innovation Solution
Perform scans of a system to detect evidence of malware intrusion, assign severity scores to each scan result, and compute an assessment score to determine the level of scrutiny and forensic examination needed for remediation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anti-virus tools are used to scan for malware, then typical malware with traces can be detected, but file-less malware cannot be detected because it leaves no typical traces
Solution Approach 1:
The detection system is segmented into multiple specialized scan types (file system scans, registry scans, memory scans, network scan) that target different potential locations where malware evidence may exist. This segmentation allows the system to comprehensively detect various forms of malware including file-less malware that may reside in memory or registry rather than traditional files.
Solution Approach 2:
The scanning system is designed with multi-functionality to handle diverse detection needs. The same scanning infrastructure can perform multiple types of scans (files, registry, memory, network) and adapt to detect different malware forms universally, making the system versatile against evolving malware threats.
2Reliability
If multiple types of scans are performed to detect all malware evidence, then detection coverage is improved, but system complexity increases
Solution Approach 1:
Multiple scan types (file system, registry, memory, network) are merged into a unified scanning system that can execute different scan types sequentially or in combination. The results from all scan types are consolidated and processed together, reducing the complexity that would arise from managing completely separate detection systems for each scan type.
Solution Approach 2:
A central processing system acts as an intermediary that coordinates the multiple scan types, manages their execution, and consolidates their results. This intermediary layer simplifies the overall system architecture by providing a single point of control and result aggregation rather than requiring direct integration between all scan components.
3Productivity
If severity scores are assigned to each scan result and assessment scores are computed, then targeted remediation can be enabled, but processing time and computational resources increase
Solution Approach 1:
The system transforms qualitative scan results into quantitative severity scores and assessment scores. By changing the parameter representation from binary (detected/not detected) to scaled values (severity levels), the system enables more nuanced prioritization and targeted remediation while maintaining computational efficiency through standardized scoring algorithms.
Solution Approach 2:
The system computes severity and assessment scores selectively based on scan results, focusing computational resources on the most relevant findings. Rather than performing exhaustive analysis on all scan data uniformly, the system applies scoring primarily to significant detections, reducing overall processing time while maintaining remediation effectiveness.
Data Source
AI summary
Approaches presented herein enable detecting and assessing evidence of malware intrusion. More specifically, scans of a system are performed, where the scans detect evidence of malware intrusion, and each of the scans generates a respective result. A severity score is assigned to each respective result of the scans, and an assessment score for the system is computed based on the severity score assigned to each respective result of the scans.