Malware Protection System with Centralized Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus systems are ineffective in detecting and preventing malicious activities by new, unknown malware types and those that circumvent system vulnerabilities, leading to potential data infiltration and damage through file, registry, system, and network activities.
Innovation Solution
A malware protection system that includes an antivirus module for signature and behavioral analysis, a data collection module for logging and monitoring system activities, and a recovery module for restoring affected data, utilizing a central antivirus server for information exchange and periodic updates to detect and mitigate malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus systems are used, then known malware can be detected, but new and unknown malware types cannot be detected in a timely manner
Solution Approach 1:
The system performs preliminary actions by continuously monitoring and logging all file, registry, system, and network activities before malicious behavior occurs. This creates a baseline of normal system operations that enables rapid detection of deviations caused by new malware, eliminating the need to wait for signature updates.
Solution Approach 2:
The system implements feedback mechanisms where detected malicious activities are immediately reported to the central antivirus server, which then distributes updated detection rules and information to all connected systems. This closed-loop feedback enables real-time adaptation to new threats without requiring full system reconfiguration.
2Reliability
If antivirus systems use vulnerability exploitation by malware, then detection may be bypassed, but system security remains vulnerable
Solution Approach 1:
The system applies preliminary anti-action by proactively monitoring for suspicious activities that may indicate vulnerability exploitation attempts. By logging and analyzing system calls, file operations, and network connections in advance, the system can identify and block malicious behaviors before they successfully compromise the system, even when targeting unknown vulnerabilities.
3Reliability
If comprehensive monitoring of all system activities is implemented, then malicious activities can be detected, but system performance and resource usage increase
Solution Approach 1:
The system extracts and separates the monitoring function into a dedicated data collection module that operates independently from the core antivirus detection engine. This modular extraction allows comprehensive activity logging to proceed without burdening the main system processes, as the monitoring overhead is isolated to a specialized component optimized for data collection rather than analysis.
4Reliability
If centralized information sharing and periodic updates are implemented, then detection capabilities are improved, but network dependency and system complexity increase
Solution Approach 1:
The system introduces a central antivirus server as an intermediary that manages the complexity of information sharing and update distribution. Individual client systems maintain relatively simple local architectures for data collection and basic analysis, while the central server handles the complex tasks of aggregating threat intelligence, generating detection rules, and coordinating updates across the network, thereby distributing complexity rather than concentrating it in each client.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are systems and methods for protecting a computer from activities of malicious objects. The method comprises: monitoring events of execution of one or more processes on the computer; identifying auditable events among the monitored events, including events of creation, alteration or deletion of files, events of alteration of system registry, and events of network access by processes executed on the computer; recording the identified auditable events in separate file, registry and network event logs; performing a malware check of one or more software objects on the computer; if an object is determined to be malicious, identifying from the file, registry and network event logs the events associated with the malicious object; performing rollback of file events associated with the malicious object; performing rollback of registry events associated with the malicious object; terminating network connections associated with the malicious object.