Malware Detection via I/O Correlation Coefficients
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods are inadequate in effectively detecting and preventing malware, particularly ransomware, attacks due to rapid evolution of malicious software, making it difficult to recognize and prevent new variants or variations until it's too late, despite standard precautions.
Innovation Solution
A malware manager system that monitors file input/output (I/O) and coordinated network I/O traffic using machine learning models to identify abnormal activity, calculates correlation coefficients, and takes remediation actions when threshold criteria are met, including blocking malicious processes and notifying distributed nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If standard malware detection methods (antivirus, whitelisting) are used, then known malware can be detected, but new malware variants cannot be recognized until too late
Solution Approach 1:
The patent changes the detection parameters from static malware signatures to dynamic I/O behavior patterns. By monitoring file I/O operations, network I/O operations, and process I/O operations in real-time, the system detects malware based on its operational characteristics rather than predefined signatures, enabling detection of new malware variants immediately upon execution
Solution Approach 2:
The patent replaces traditional mechanical malware detection methods (signature matching, heuristic analysis) with a data-driven approach using machine learning models. The system collects I/O operation data, trains machine learning models to identify malicious patterns, and uses these models to detect new malware variants, substituting rule-based systems with adaptive intelligent systems
2Reliability
If I/O monitoring is implemented to detect abnormal activity, then malware detection capability is improved, but system complexity increases
Solution Approach 1:
The patent segments the complex monitoring task into distinct components: file I/O monitoring, network I/O monitoring, process I/O monitoring, and machine learning model training. Each component handles a specific aspect of malware detection, making the overall system more manageable and maintainable while improving detection reliability through comprehensive coverage
Solution Approach 2:
The patent introduces machine learning models as intermediaries between raw I/O operation data and malware detection decisions. These models process and interpret the complex I/O patterns, translating low-level operational data into high-level security assessments, thereby reducing the complexity burden on the detection system architecture
3Measurement precision
If comprehensive I/O monitoring is performed to identify abnormal patterns, then detection precision is improved, but computational resources are consumed
Solution Approach 1:
The patent performs preliminary actions by collecting and storing I/O operation data before malware execution patterns become problematic. The system pre-processes and archives file I/O, network I/O, and process I/O operations, creating a historical dataset that can be analyzed by machine learning models without requiring intensive real-time computation during active monitoring
Solution Approach 2:
The patent implements partial monitoring by focusing on specific I/O operations that are most indicative of malware behavior. Rather than monitoring all system operations equally, the system prioritizes file I/O, network I/O, and process I/O operations that show abnormal patterns, reducing overall computational overhead while maintaining detection precision
Data Source
AI summary
A malware attack is detected in a computing system by monitoring file I/O and coordinated network I/O traffic and referencing criteria including a correlation coefficient calculated relative to the I/O. If the file I/O and coordinated network I/O was initiated by an executing process that meets criteria indicative of malware, a correlation coefficient is calculated with respect to the file I/O and coordinated network I/O. The executing process is identified as malware if a threshold criteria is met that considers the correlation coefficient.