Module Reputation Monitoring for Malicious Behavior Detection

Solution Overview

Problem

Existing systems fail to effectively detect and neutralize malicious trusted modules that have changed their behavior, posing a risk as they can exploit host computer systems by embedding malicious code.

Innovation Solution

A method and system that monitor a module's behavior when its reputation is formed, detecting changes and revoking the original reputation if behavior deviates from expected norms, thereby identifying and defeating malicious trusted modules.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a module's reputation is established based on initial behavior, then the module is granted trust and allowed to operate, but the system becomes vulnerable to malicious code that changes behavior after gaining trust

Engineering Contradiction:

Improvemodule trustworthinessVSAvoidmalicious code exploitation

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary behavior monitoring during a reputation formation period before granting full trust. A reputation manifest is created based on observed behavior during this period, establishing a baseline of expected behavior before the module gains full operational privileges.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system continuously monitors module behavior against the established reputation manifest and provides feedback by detecting deviations. When behavior changes are detected, the system responds by revoking the reputation and blocking the module, creating a closed-loop security mechanism.

Inventive Principle:

Principle #23Feedback

2Object-affected harmful factors

If the system continuously monitors module behavior to detect malicious changes, then security is improved, but system complexity and computational overhead increase

Engineering Contradiction:

Improvemalicious behavior detectionVSAvoidmonitoring system complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The system performs preliminary behavior monitoring during a reputation formation period before granting full trust. A reputation manifest is created based on observed behavior during this period, establishing a baseline of expected behavior before the module gains full operational privileges.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system changes the monitoring parameter from continuous detailed analysis to deviation detection against a predefined manifest. This reduces computational complexity by only checking whether behavior matches the established pattern rather than analyzing all behavioral aspects continuously.

Inventive Principle:

Principle #35Parameter changes

3Object-affected harmful factors

If the system revokes reputation upon detecting behavior changes, then malicious modules are neutralized, but legitimate modules with updated functionality may be falsely blocked

Engineering Contradiction:

Improvemalicious module neutralizationVSAvoidlegitimate module functionality

Core Design Contradiction:

Object-affected harmful factorsVSAdaptability or versatility

Solution Approach 1:

The system performs preliminary behavior monitoring during a reputation formation period before granting full trust. A reputation manifest is created based on observed behavior during this period, establishing a baseline of expected behavior before the module gains full operational privileges.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system dynamically adjusts the reputation status based on behavior monitoring results. Legitimate modules can maintain their reputation as long as they operate within expected parameters, while malicious modules are dynamically blocked when deviations are detected, allowing the system to adapt to actual module behavior.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentEP2316089B1Software reputation establishment and monitoring system and method

Publication Date: 2016.11.30 GEN DIGITAL INC

Figure 1
Figure 2
Figure 3

AI summary

Knowledge of a module's behavior when the module's reputation is formed is obtained. If the module's behavior changes, this change is detected. In one embodiment, upon a determination that the module's behavior has changed, the module's original reputation is lost. In this manner, malicious trusted modules are detected and defeated.