Per-Process Security Policies via Static Analysis for Malware Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security programs struggle to effectively protect computers from malicious programs by monitoring and blocking them at a process level, leading to decreased system performance due to real-time monitoring and treatment processes.
Innovation Solution
Performing static analysis on programs to divide them into processes or threads, setting security policies for each, monitoring for policy violations, and generating notifications when violations occur, with the ability to pause execution if necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If real-time monitoring and treatment of malicious programs is performed, then security protection capability is improved, but system performance decreases
Solution Approach 1:
The patent performs static analysis on programs before execution to identify malicious code and set security policies in advance. This preliminary action allows the system to prepare security measures without impacting runtime performance, as the analysis and policy creation occur before the program is executed
Solution Approach 2:
The patent divides a program into multiple processes or threads and sets security policies for each segment independently. This segmentation allows selective monitoring and treatment of only those segments that violate security policies, rather than monitoring the entire program, thus reducing the overall monitoring overhead and preserving system performance
2Reliability
If security policies are applied to entire programs, then security coverage is improved, but detection precision decreases
Solution Approach 1:
The patent divides a program into multiple processes or threads and applies security policies at this finer granularity level. This segmentation enables precise identification of which specific process or thread violates security policies, improving detection precision while maintaining comprehensive security coverage across the entire program
Solution Approach 2:
The patent sets different security policies for different processes or threads within a program based on their specific characteristics and risk levels. This local quality approach allows tailored security measures for each segment, improving both coverage and precision by addressing specific vulnerabilities in specific processes rather than applying blanket policies
Data Source
AI summary
One or more embodiments relate to a security setting device, a method of setting a per-process security policy, and a computer program stored in a recording medium to execute the method, and more particularly, to a security setting device configured to protect an electronic device from external attacks to a program by performing static analysis with respect to the program to set security policies for processes included in the program and monitor whether there have been violations on the security policy, a method of security setting, and a computer program stored in a recording medium to execute the method.