Malware Detection via Thread Monitoring and Suspicious Patch Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware solutions are ineffective in early detection of malware presence, as malware evolves to make identification difficult, often injecting malicious code into legitimate system processes, particularly targeting browsers.
Innovation Solution
A monitoring agent identifies potentially harmful malware by tracking executable processes, monitoring threads, and creating hooks to detect suspicious activity, such as the creation of remote threads and patches in target processes like browsers, using cryptographic hash algorithms and maintaining a whitelist of legitimate processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If periodic scanning for malware signatures is used, then malware detection is performed, but detection occurs too late and malware evolves to evade detection
Solution Approach 1:
The system performs preliminary monitoring of executable files and their thread activities before malware can execute harmful actions. By tracking the creation of remote threads and suspicious patches in target processes like browsers, the system detects malware at an early stage, preventing the loss of time associated with periodic scanning detection.
2Measurement precision
If comprehensive monitoring of all threads is implemented, then malware detection accuracy improves, but system performance and complexity increase
Solution Approach 1:
The monitoring agent focuses its comprehensive monitoring capabilities on specific high-risk areas: tracking threads descended from executable processes and monitoring for remote thread creation in target processes like browsers. This localized approach maintains high detection accuracy while reducing overall system complexity by not monitoring every thread in the system equally.
Solution Approach 2:
The system changes monitoring parameters dynamically - it intensively monitors threads from executable processes and looks for specific suspicious behaviors (remote thread creation, suspicious patches), while using lighter monitoring for other system activities. This parameter-based approach balances detection accuracy with system complexity.
3Measurement precision
If cryptographic hash algorithms are used to track executables, then malware identification improves, but processing overhead increases
Solution Approach 1:
The system applies cryptographic hash algorithms selectively - computing hashes for executable files that are about to run and for processes that exhibit suspicious behavior, rather than continuously hashing all processes. This partial application maintains identification accuracy while reducing processing energy consumption.
Data Source
AI summary
A process for identifying potentially harmful malware, comprises the steps of: a) identifying an executable that is about to run; b) providing a monitoring agent that monitors all threads that are descendent of a thread initiated by the process of said executable; and c) configuring said monitoring agent to conclude that a high probability of malware presence exists, if one of said descendent threads reaches a target process in which suspicious patches are created.