Malware Protection via Graph Betweenness Centrality
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware protection mechanisms are reactive and often impractical for rapid deployment across critical computer systems, leading to potential system unavailability during malware propagation.
Innovation Solution
A computer-implemented malware protection method that uses a graph model to identify interacting computer systems, iteratively ranks and removes nodes by betweenness centrality, and deploys protection measures at strategically selected nodes to mitigate malware spread.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional reactive malware protection mechanisms are deployed across an entire population of susceptible hosts, then comprehensive malware coverage is achieved, but system availability is compromised during the critical malware propagation period
Solution Approach 1:
The patent applies local quality by deploying malware protection measures selectively to specific high-risk computer systems identified through graph analysis, rather than uniformly across all systems. The method identifies connected components in the network graph and targets protection deployment to systems within these components, particularly those with high betweenness centrality, thereby achieving effective malware coverage while minimizing disruption to overall system availability.
2Speed
If malware protection measures are deployed rapidly across all susceptible hosts, then malware spread is mitigated quickly, but deployment complexity and resource requirements increase
Solution Approach 1:
The patent applies segmentation by dividing the network into connected components based on graph analysis, and further segmenting protection deployment into prioritized groups based on betweenness centrality metrics. This allows rapid deployment to be focused on high-priority segments (connected components with high betweenness nodes) while deferring or skipping lower-priority segments, thereby achieving quick mitigation without requiring simultaneous deployment across the entire network.
Solution Approach 2:
The patent applies partial action by deploying protection measures to a subset of high-risk systems rather than all susceptible hosts. By identifying and protecting only the most critical nodes (those with high betweenness centrality within connected components), the method achieves effective malware containment with reduced deployment complexity and resource requirements compared to universal deployment.
3Reliability
If targeted protection is deployed only to high-betweenness nodes, then malware spread is effectively blocked, but the number of protected systems may be insufficient to cover all transmission paths
Solution Approach 1:
The patent applies preliminary action by performing graph analysis and identifying connected components and high-betweenness nodes before deploying protection measures. This advance identification allows the system to proactively protect critical nodes before malware propagation occurs, ensuring that protection is in place at the most vulnerable points in the network topology, thereby achieving effective blocking with minimal protected systems.
Data Source
AI summary
A computer implemented malware protection method to mitigate malware spread within a set of communicating computer systems from an infected computer system is disclosed.