Malware Downloader Detection via Timestamp Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-malware methods, such as signature-based detection and URL-filtering, are inadequate in addressing the delivery of web threats as they require frequent updates, consume significant resources, and are ineffective against new malware variants.
Innovation Solution
A pattern-less technique that detects malware downloaders by comparing the timestamp of an executable file with the current time to determine if it was recently downloaded, and checks if the process is a parent of a normal program or downloaded by a registered web browser, flagging and stopping it if it is not.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection is used, then malware detection capability is improved, but storage requirements and update frequency increase
Solution Approach 1:
The patent extracts the detection mechanism from signature-based approaches and time-based approaches, creating a process-based detection system that monitors the execution characteristics and behavior patterns of processes rather than relying on stored signatures or timestamps. This extraction eliminates the need for large signature databases while maintaining detection effectiveness.
Solution Approach 2:
The patent replaces the mechanical storage and comparison of digital signatures with a dynamic monitoring system that tracks process behavior, execution contexts, and system interactions. This substitution eliminates the need for extensive storage resources while providing adaptive detection capabilities.
2Reliability
If URL-filtering is used, then web threat blocking is improved, but device complexity and maintenance requirements increase
Solution Approach 1:
The system performs self-service by automatically analyzing process behavior patterns and execution contexts without requiring manual configuration of URL filters or threat lists. The detection mechanism self-adapts to normal system operations and automatically identifies anomalies, eliminating the need for continuous manual maintenance of filtering rules.
Solution Approach 2:
The patent introduces dynamic monitoring of process execution characteristics rather than static URL filtering. The system continuously adapts its monitoring based on real-time process behavior, execution contexts, and system interactions, providing flexible threat detection without the rigidity and maintenance burden of static URL-filtering databases.
3Reliability
If conventional anti-malware methods are used, then existing malware protection is improved, but effectiveness against new malware variants decreases
Solution Approach 1:
The patent applies preliminary action by establishing baseline behavior patterns and execution contexts before malware infection occurs. The system monitors processes during their normal execution and compares observed behavior against established patterns, enabling early detection of malicious behavior before traditional signature-based methods can identify the malware variant.
Solution Approach 2:
The system detects malware by monitoring changes in process parameters, execution contexts, and behavior patterns rather than relying on fixed signatures. This parameter-based detection approach adapts to new malware variants by identifying anomalies in execution characteristics, maintaining effectiveness against evolving threats without requiring signature updates.
Data Source
AI summary
One embodiment relates to a computer-implemented method of detecting a malware downloader running on a computer system. An indication is received that a process running on the computer system is attempting to execute an executable file. A timestamp of the executable file is obtained. The timestamp indicates a time at which the executable file was downloaded. A current time is also obtained from the computer system. A determination is made as to whether the current time is approximately equal to the time indicated by the timestamp. An indication is made that said process is not a malware downloader if the current time is not approximately equal to the time indicated by the timestamp. Another embodiment relates to a computer apparatus configured to detect a malware downloader. Other embodiments, aspects and features are also disclosed.