Automated Malware Repair Module Generation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current methods for cleaning malware from computing devices are inefficient due to the manual generation of generic clean patterns, which are not tailored to specific malware and require significant time and resources, struggling to keep pace with the increasing sophistication and proliferation of malware.

Innovation Solution

A method for automatically generating a customized malware repair module by querying a remote malware behavior database, creating a tailored data set specific to the computing device, and executing a repair software module to delete malware and restore the device to a normal state.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual generation of generic clean patterns is used, then immediate execution is possible, but the clean patterns cannot deal with special malware behavior and are insufficient for sophisticated malware

Engineering Contradiction:

Improvemalware cleanup effectivenessVSAvoidcapability to handle special malware behavior

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system enables self-service by allowing the computing device to automatically generate customized clean patterns for detected malware. The malware detection engine identifies malware characteristics, queries remote databases, and generates appropriate clean patterns without requiring manual intervention from security analysts, thus resolving the contradiction between immediate execution and specialized handling capability

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system changes parameters by transitioning from static generic clean patterns to dynamic customized patterns. The clean pattern generation component modifies parameters such as deletion commands, restoration procedures, and cleanup operations based on the specific malware detected, enabling both immediate response and specialized handling for different malware types

Inventive Principle:

Principle #35Parameter changes

2Reliability

If manual generation of customized clean patterns is used, then specific malware targeting is achieved, but the process is time-consuming and resource-intensive

Engineering Contradiction:

Improvetailored clean pattern accuracyVSAvoidclean pattern generation speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system uses copying by retrieving existing clean pattern templates from remote databases and adapting them to the specific malware case. Instead of creating clean patterns from scratch manually, the system copies relevant patterns and customizes them, significantly reducing generation time while maintaining accuracy for the specific malware type

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The system performs preliminary action by pre-storing clean pattern templates and malware behavior data in remote databases. When malware is detected, the system queries these pre-prepared resources and generates customized patterns quickly, avoiding the time-consuming manual creation process while ensuring tailored accuracy

Inventive Principle:

Principle #10Preliminary action

3Speed

If generic clean patterns are used, then rapid deployment is possible, but they perform only basic clean-up and cannot restore complex malware damage

Engineering Contradiction:

Improveclean pattern execution speedVSAvoidrestoration capability for malware damage

Core Design Contradiction:

SpeedVSEase of repair

Solution Approach 1:

The system introduces dynamics by making clean patterns adaptive rather than static. The clean pattern generation component dynamically adjusts the cleanup and restoration operations based on the specific malware characteristics detected, enabling both rapid execution and comprehensive restoration capability for different malware scenarios

Inventive Principle:

Principle #15Dynamics

4Reliability

If manual analysis and generation of clean patterns is used, then specialized knowledge is applied, but the volume of malware activity makes it impossible to keep pace with malware proliferation

Engineering Contradiction:

Improveexpert-level clean pattern qualityVSAvoidclean pattern generation throughput

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system replaces the mechanical system of manual analysis and writing clean patterns with an automated computational system. The malware detection engine automatically analyzes malware behavior, queries remote databases, and generates customized clean patterns using algorithms and rules, eliminating the bottleneck of manual production while maintaining expert-quality results through sophisticated automated reasoning

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS8739283B1Automatic generation of malware clean pattern

Publication Date: 2014.05.27 TREND MICRO INC

AI summary

A computing device is capable of automatically detecting malware execution and cleaning the effects of malware execution using a malware repair module that is customized to the operating features and characteristics of the computing device. The computing device has software modules, hardware components, and network interfaces for accessing remote sources which, collectively, enable the device to restore itself after malware has executed on it. These modules, components, and interfaces may also enable the apparatus to delete the malware, if not entirely, at least partially so that it can no longer execute and cause further harm. The malware repair module is created from a detailed malware behavior data set retrieved from a remote malware behavior database and then modified to take into account specific operating features of the computing device. The repair module executes on a repair module execution engine and the effects of the malware on the device are minimized.