Object Reputation Tracking for Polymorphic Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in detecting and mitigating polymorphic malware that registers itself with the operating system to persist on infected computers, as it evades detection by changing its backing file and fingerprint, making signature-based scanning ineffective.
Innovation Solution
An object reputation management system that tracks the creations of objects by files, determines the security reputations of these objects, and blocks malicious files from registering with the operating system, using a database to calculate and adjust security reputations based on file activity, thereby identifying and preventing malware activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based scanning is used to detect malware, then detection of known malware is effective, but polymorphic malware that changes its backing file can evade detection
Solution Approach 1:
The system performs preliminary actions by tracking object creations before malware can fully establish persistence. By monitoring and recording objects created by executables during their initial execution, the system builds a baseline reputation profile that enables future detection of malicious behavior patterns, allowing detection before the malware completes its full malicious cycle
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring object creation activities and updating security reputations in real-time. When an executable creates suspicious objects or exhibits malicious patterns, the system feeds this information back into the reputation system, which then adjusts security policies and blocks further malicious activities, creating a closed-loop detection and response system
2Adaptability or versatility
If polymorphic malware changes its backing file with every infection, then it avoids signature-based detection, but its security reputation should remain detectable through consistent behavior patterns
Solution Approach 1:
The system extracts and isolates the immutable behavioral characteristics of malware from its changing code form. By focusing specifically on object creation patterns, registry modifications, and execution behaviors rather than code signatures, the system separates the detectable malicious intent from the polymorphic code wrapper, enabling reliable detection regardless of code transformation
Solution Approach 2:
The system changes the detection approach from looking at the 'color' of the code (signatures, hashes, static characteristics) to looking at the 'color' of the behavior (object creation patterns, execution sequences, modification activities). This behavioral fingerprinting approach remains consistent even when the code's apparent characteristics change with each polymorphic transformation
3Speed
If traditional signature-based scanning is used, then detection speed is fast for known threats, but it fails to identify changed backing files of malware
Solution Approach 1:
The system performs preliminary tracking of object creations during initial execution, building reputation data before malware can spread or mutate. This pre-computed behavioral baseline enables rapid future decisions about malicious files without requiring slow, comprehensive analysis each time
Solution Approach 2:
The system enables files and executables to essentially self-report their behavior through the object creation tracking mechanism. By automatically monitoring what objects each executable creates and updating their own security reputations based on this self-generated data, the system achieves fast, automated detection without requiring external analysis for each file
Data Source
AI summary
The creations of objects by files that have not been previously identified as malware are tracked. The security reputations of specific created objects are determined. Based on the determined security reputations of specific created objects, the security risks concerning the specific files that created the objects are determined. Responsive to whether a determined security risk concerning a specific creating file meets a given threshold, it is determined whether the specific creating file comprises malware. Responsive to determining that a specific creating file comprises malware, the creating file is blocked from performing the activity associated with the creation of the associated object. Responsive to determining that a creating file comprises malware, the creating file can be disabled, and an alert concerning the creating file can be transmitted to a central security server.