Malware Detection Using File Prevalence and Maturity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods rely on virus pattern files and behavior-based heuristics, which are costly and inefficient, especially when dealing with zero-day malware and dropped files that lack signatures or detection rules.
Innovation Solution
An antivirus software system that detects and removes malware by determining the creation or modification time of suspicious files within a time window, using prevalence and maturity values to identify and delete files without relying on virus signatures or patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virus signature matching or behavior-based heuristic techniques are used to detect malware, then known malware can be detected, but constant effort and cost are required to maintain protection against new malware variants
Solution Approach 1:
The system performs preliminary analysis of file characteristics (prevalence and maturity values) before malware variants are created. By pre-establishing detection criteria based on file age and occurrence frequency, the system can detect new malware immediately upon infection without requiring post-creation analysis or pattern updates.
Solution Approach 2:
The system enables malware files to self-identify as malicious through their own characteristics. Files with low prevalence (rare on the system) and low maturity (recently created) automatically flag themselves as suspicious, eliminating the need for external pattern matching or heuristic analysis.
2Reliability
If virus pattern files are created and deployed to detect malware, then signature-based detection works for known viruses, but dropped files from zero-day malware cannot be detected as they lack signatures
Solution Approach 1:
The system changes the detection parameters from content-based (virus signatures) to metadata-based (creation time and prevalence). By monitoring when files are created and how frequently they appear across systems, the system can detect any malware regardless of its content or variant, including zero-day threats and dropped files.
3Reliability
If behavior-based heuristic rules are developed and deployed, then malware behavior can be detected, but the cost and effort of rule development increases continuously
Solution Approach 1:
The system extracts only the essential characteristics needed for malware detection (prevalence and maturity values) from the complex behavior analysis process. By focusing on these two key parameters rather than analyzing multiple behavioral indicators, the system achieves effective detection with minimal complexity.
Data Source
AI summary
Antivirus software detects malware on a computer and the landing time of the malware is determined; a time window around the landing time is determined. Optionally requiring the landing time of the malware to be before the installation time of the antivirus software eliminates false positives. Any files of the computer systems that have a creation time within the time window are suspect. If the prevalence value and the maturity value of the suspect file are below respective thresholds then it is concluded that the file is malware and it is deleted. No virus signature or virus pattern that matches the deleted file need be relied upon or used. The detected malware may be the original mother file or a dropped file. An online prevalence and maturity database is used. The launching time of the malware may be used instead of the landing time.