Pre-scan Malware Detection via Historical URL Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current pre-scan techniques for malware detection on computers are limited by outdated virus patterns, inability to perform heuristic-based detection, and lack of anti-rootkit modules, leading to potential misses in malware detection, especially since much malware originates from the Internet and can evade antivirus software installation.
Innovation Solution
A prescan technique that utilizes historical URL information by querying an online service database for malicious URLs, associated files, and cleanup patterns, allowing for faster and targeted detection of malware before antivirus software is installed, including monitoring network data and calculating cryptographic signatures to identify and report malicious files and their locations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a pre-scan uses signature-based virus pattern files, then the scan speed is improved and critical areas can be checked quickly, but the detection reliability deteriorates because the virus pattern may not be up to date and may not include signatures of the latest malware
Solution Approach 1:
The system performs preliminary actions by obtaining and analyzing malware samples before they become widespread threats. The online service proactively collects malware samples, analyzes them to extract indicators of compromise (IOCs), and makes this intelligence available to prescan modules before the malware can infect users' systems. This preliminary analysis enables the prescan to detect emerging threats without waiting for signature pattern updates.
Solution Approach 2:
An online service acts as an intermediary between malware analysis and prescan detection. The online service receives malware samples, performs sophisticated analysis to extract IOCs including URLs, file hashes, registry keys, and behavioral patterns, then delivers this intelligence to the prescan module. This intermediary enables the prescan to access advanced threat intelligence without requiring a full antivirus installation or heuristic monitoring.
2Reliability
If a pre-scan performs heuristic-based detection or uses anti-rootkit modules, then the malware detection capability is improved, but the device complexity and installation requirements worsen because these features require installed antivirus software
Solution Approach 1:
The invention extracts and isolates the prescan functionality from the full antivirus package, creating a standalone module that can operate independently. The prescan module contains only the essential components needed for preliminary detection: signature matching engine, online service client for obtaining IOCs, and basic scanning algorithms. Advanced features like heuristic analysis and rootkit detection are deliberately excluded to maintain the lightweight, non-intrusive nature of the prescan while still providing effective malware detection through optimized signature and IOC-based detection.
3Productivity
If a pre-scan checks only critical areas of the disk, then the scan time is reduced and productivity is improved, but the measurement precision deteriorates because some malware may be missed in non-critical areas
Solution Approach 1:
The prescan module applies local quality by concentrating scanning resources on locations and files most likely to contain malware based on obtained IOCs. Rather than uniformly scanning the entire disk or relying solely on predefined critical areas, the system dynamically identifies high-priority targets from IOC data (specific file paths, registry keys, URL histories) and directs intensive scanning to those locations. This targeted approach achieves comprehensive detection of known threats while maintaining scan efficiency.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach enables quicker detection of new malware, counters rootkit malware, and reduces the need for extensive disk searches by focusing on specific areas, improving the effectiveness of pre-scan operations and enhancing malware detection before antivirus software is fully installed.
Implementation Method 1
A monitor monitors network data and obtains URLs and associated files downloaded from those URLs. A cryptographic signature of each downloaded file is calculated.
Data Source
AI summary
A Web browser or operating system of a computer maintains a historical URL list of Web sites and Web pages that have been accessed in the past. When a prescan module of antivirus software performs an initial prescan of a computer before the antivirus software is installed, it queries this historical URL list to obtain the URLs that have been accessed in the past. These URLs are sent to a URL online query service located remotely over the Internet in order to determine the status of any of these URLs. Each URL is attempted to be matched with a database of known malicious URLs including associated malicious files and associated cleanup patterns. The query service then informs the requesting computer of the status of a particular URL sent, sending back any related malicious files and any appropriate cleanup pattern. A time period associated with each URL in the database indicates when it is known that the URL was malicious.