Process-Based Event Filtering for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional anti-malware systems face performance degradation due to processing large numbers of benign events, and often fail to detect security threats associated with file openings by processes, as they lack efficient event classification and filtering mechanisms.
Innovation Solution
A method and system that intercept events initiated by processes, determine the necessity of a security scan based on event classification information, and selectively send events to a user mode service for scanning, allowing benign events to proceed without scanning and blocking potentially malicious ones, using a kernel driver that references event classification information to filter events intelligently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anti-malware software captures and processes all events for every process, then comprehensive security coverage is achieved, but device performance degrades due to processing large numbers of benign events
Solution Approach 1:
The patent segments the event processing workload by dividing events into different categories (benign vs. potentially malicious) based on process identification. The security software selectively processes only relevant events while allowing benign events to pass through without scanning, thus maintaining security coverage for critical events while improving overall device performance by eliminating unnecessary processing of benign events.
2Reliability
If security scans are performed on all events, then malware detection capability is maximized, but processing time increases and performance degrades
Solution Approach 1:
The patent applies preliminary action by identifying and classifying processes before event processing occurs. The system pre-establishes which processes are benign and which require security scanning, so that when events occur, the decision to scan or allow has already been made in advance. This eliminates the need for real-time analysis of every event, significantly reducing processing time while maintaining malware detection capability for relevant events.
3Productivity
If event classification information is stored and referenced for each process, then selective event filtering is enabled, but system complexity increases
Solution Approach 1:
The patent uses copying by creating simplified representations of process information (process identification data) that can be quickly referenced. Instead of maintaining complex analysis of each process, the system stores and references copied process identification information that indicates whether a process is benign or requires scanning. This copying approach enables efficient event filtering without the full complexity of continuous process analysis.
Data Source
AI summary
Systems and methods to scan for malware on devices based on process identification. In some implementations, a computer-implemented method includes intercepting an event initiated by a particular process that executes on a system, which pauses the event. It is determined whether to perform a security scan for the event based on a comparison of a type of the event with stored event classification information associated with the particular process. If performing the security scan, a scan of the intercepted event is performed (e.g., sent to a user mode service that executes on the system), and based on the scan, the intercepted event is allowed to proceed or a security operation is performed associated with the intercepted event. If not performing the security scan, the intercepted event is allowed to proceed.