Malware Infection Prediction Using Telemetry Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies lack effective methods to predict and prevent malware infections in computing devices, relying on post-infection detection rather than proactive measures.
Innovation Solution
A malware infection prediction method using telemetry data from client devices, which involves a trained model to predict infection likelihood and generate recommendations for reducing the risk, including notifications for administrative accounts and client devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If post-infection detection methods are used, then malware detection capability is maintained, but proactive prevention capability is lost
Solution Approach 1:
The system performs preliminary actions by collecting telemetry data and training machine learning models to predict malware infections before they occur. The model analyzes historical telemetry data to identify patterns that precede infections, enabling the system to generate predictions and recommendations in advance, thus preventing the time loss associated with post-infection detection.
Solution Approach 2:
The system implements feedback by continuously collecting telemetry data from client devices, comparing it against the trained machine learning model, and generating predictions about future infections. This feedback loop allows the system to adjust recommendations based on actual infection outcomes, improving both detection accuracy and proactive prevention capability over time.
2Measurement precision
If telemetry data collection is implemented, then prediction accuracy is improved, but system complexity increases
Solution Approach 1:
The system applies universality by using a single machine learning model framework that can process multiple types of telemetry data (device configuration, user behavior, network activity) to predict different malware infection scenarios. This multi-functional approach improves prediction accuracy without proportionally increasing system complexity, as the same core model handles diverse data inputs.
Solution Approach 2:
The patent introduces an intermediary machine learning model that acts as a mediator between raw telemetry data and infection predictions. This intermediary component processes and interprets complex telemetry data, transforming it into actionable predictions while managing system complexity by encapsulating the analytical logic within the trained model rather than requiring complex processing infrastructure.
3Reliability
If proactive prediction system is deployed, then prevention capability is enhanced, but resource consumption increases
Solution Approach 1:
The system applies partial action by generating predictions and recommendations only when the machine learning model identifies significant infection risks based on telemetry data patterns. Rather than continuously analyzing all telemetry data, the system activates prediction functions selectively, reducing computational resource consumption while maintaining effective proactive defense when needed.
Solution Approach 2:
The patent employs lightweight machine learning models that can be quickly trained and deployed on client devices with limited computational resources. These models are designed to be computationally efficient, consuming minimal energy while providing effective prediction capabilities, and can be updated or replaced as needed without requiring substantial computational infrastructure.
Data Source
AI summary
A malware infection prediction method predicts a likelihood that a client device is to be infected with in a period of time based on state and behavior telemetry data. A malware infection prediction system receives telemetry data associated with use (i.e. behavior data) and configuration (i.e. state data) of a client device. By using a trained model, the system predicts a likelihood of the client device becoming infected within a given time frame. Based on the predicted likelihood, the system generates recommendations including recommended actions for reducing the likelihood of the client device becoming infected. The system then generates notifications including the recommendations and sends the notifications to the client device or to an administrative account associated with the client device.