Multilayered Heuristics Malware Detection System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious programs are inadequate as they rely on single approaches, such as emulation, API hooking, or behavior monitoring, and fail to effectively address sophisticated attacks, particularly '0-day' threats, and require frequent updates, leading to high support costs.
Innovation Solution
A multilayered heuristics approach combining static, disassembling, and dynamic analysis using virtualization technology, where suspicious code is analyzed through multiple layers to identify malware, including static analysis, disassembling to search for patterns, and dynamic analysis in an isolated environment to monitor behavior, reducing the need for frequent updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single heuristics approach (emulation, API hooking, or behavior monitoring) is used, then the detection method is simple and focused, but it fails to effectively detect sophisticated attacks and requires frequent updates
Solution Approach 1:
The patent divides the malware detection system into multiple independent analysis layers including static analysis, dynamic analysis, behavior monitoring, and heuristics analysis. Each layer operates independently with its own specialized techniques, allowing the system to handle sophisticated attacks through combined coverage while maintaining manageable complexity through modular architecture
Solution Approach 2:
The patent combines multiple complementary detection methods (static analysis, dynamic analysis, behavior monitoring, heuristics) into a unified multilayered system. Each method compensates for the weaknesses of others, creating a synergistic effect that improves overall detection reliability without requiring frequent updates for new threats
2Measurement precision
If multiple analysis methods are combined into a multilayered approach, then detection accuracy improves and frequent updates are reduced, but system complexity increases
Solution Approach 1:
The detection system is segmented into distinct analysis layers (static, dynamic, behavior, heuristics) that can be implemented and maintained independently. This segmentation allows high detection accuracy through comprehensive coverage while controlling complexity through modular design where each layer has specialized, focused functionality
Solution Approach 2:
The multilayered system creates a universal detection framework that handles multiple types of malware and attack vectors through a single integrated architecture. This multi-functionality achieves high detection accuracy across diverse threats while reducing the need for separate specialized systems, thereby managing overall complexity
3Adaptability or versatility
If frequent updates are released to address new threats, then detection capability is maintained, but support costs increase
Solution Approach 1:
The system performs preliminary static analysis and heuristic evaluation before full dynamic analysis, pre-identifying suspicious patterns that reduce the need for frequent updates. The behavior monitoring layer establishes baseline characteristics of malware families, allowing the system to adapt to new variants without requiring constant updates to detection signatures
Solution Approach 2:
The heuristics analysis layer enables the system to self-adapt to new malware by automatically analyzing behavioral patterns and updating detection rules based on observed characteristics. This self-service capability maintains high adaptability to new threats while minimizing external support intervention and associated costs
Data Source
AI summary
Three heuristic layers are used to determine whether suspicious code received at a port of a data processing device is malware. First, static analysis is applied to the suspicious code. If the suspicious code passes the static analysis, dissembling analysis is applied to the suspicious code. Preferably, if the suspicious code passes the dissembling analysis, dynamic analysis is applied to the suspicious code.