Malware Detection via Telemetry Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods rely heavily on human intervention and signature-based approaches, which are labor-intensive and ineffective against constantly evolving malware, as developers adapt and modify their malware to evade detection, leading to delayed identification and protection.
Innovation Solution
A system and method utilizing cloud and distributed computing to analyze telemetry data from multiple machines, identifying common source events associated with malware infections, allowing for automatic detection and protection without relying on file signatures, by correlating unknown files with potentially compromised sites and blocking access to malicious sources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based malware detection is used, then malware can be identified when signatures are known, but malware developers can constantly adapt and modify malware to evade detection, requiring continuous signature updates and human intervention
Solution Approach 1:
The system performs preliminary analysis by examining telemetry data from multiple machines to identify common source events before malware can be widely distributed. By proactively detecting source events that precede malware infections across multiple devices, the system establishes detection capabilities in advance, eliminating the need to wait for signature creation after malware appears in the wild.
Solution Approach 2:
The system introduces telemetry data as an intermediary between malware execution and detection. Instead of directly analyzing malware files or waiting for infections, the system uses telemetry data from multiple machines as a mediator to indirectly detect source events and identify malware patterns, enabling detection without requiring traditional signatures.
2Reliability
If human researchers manually analyze malware files to create signatures, then detection accuracy can be maintained, but the process is labor-intensive and time-consuming, allowing malware to remain active in the wild longer
Solution Approach 1:
The system enables self-service detection by automatically analyzing telemetry data from multiple machines to identify source events without requiring human researcher intervention. The automated analysis of aggregated telemetry data allows the system to independently detect malware patterns and generate detection rules, eliminating the time-consuming manual analysis process while maintaining high detection accuracy.
Solution Approach 2:
The system merges telemetry data from multiple machines to collectively identify source events. By combining data across numerous devices and analyzing common patterns, the system achieves robust detection capabilities that automatically identify malware source events, replacing the need for individual human researchers to manually analyze each malware instance.
3Ease of operation
If traditional malware analysis systems analyze individual machines separately, then detailed local context is obtained, but the system cannot identify common source events across multiple infections, reducing proactive detection capability
Solution Approach 1:
The system merges telemetry data from multiple machines to identify common source events. By aggregating and analyzing telemetry data across numerous devices simultaneously, the system can detect patterns and source events that span multiple infections, significantly improving source event identification accuracy while maintaining operational simplicity through automated centralized analysis.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein is a system and method for identifying potential sources of malicious activity as well as identifying potentially malicious files that originated from suspected malicious sources. Using an anchor event and telemetry data from devices known to have been infected by malicious activity similar events in the telemetry data between two devices can be identified. These satellite events are then used to identify other files that may have been deposited by the satellite event such that those files can be highlighted to a malware researcher. Additionally, the malware protection may be updated based on this analysis to label an associated site with the satellite event as a malicious site such that the site may be blocked or quarantined.