Malicious Program Detection via Process Set Correlation Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional virus-scanning methods lag behind new virus emergence, struggling to detect concealed malicious programs that initiate multiple processes, leading to ineffective real-time monitoring and increased economic losses.
Innovation Solution
A method and apparatus that monitor and analyze the behavior of computer programs by creating and maintaining process sets, correlating suspicious processes to detect malicious behavior through correlation analysis, combining with antivirus engine results for enhanced detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature scanning method is used, then virus detection can be performed, but detection lags behind new virus emergence
Solution Approach 1:
The patent performs preliminary actions by monitoring and recording process sets before virus signatures are available. It establishes baseline behavior patterns of legitimate processes in advance, enabling immediate detection of anomalies when new viruses emerge without waiting for signature updates.
Solution Approach 2:
The patent segments virus detection into two independent components: signature-based detection and behavior-based detection. The behavior monitoring system operates independently and can detect viruses immediately through process set analysis, while signature scanning provides additional confirmation, eliminating the sequential dependency that causes delays.
2Adaptability or versatility
If behavior characteristics analysis is used, then new virus varieties can be recognized, but concealed viruses with multiple processes remain undetected
Solution Approach 1:
The patent merges multiple individual process monitoring into a unified process set analysis. By combining information from parent processes, child processes, and associated files into a single process set, the system detects concealed viruses that spread across multiple processes, achieving both adaptability to new viruses and precision in detecting complex concealed threats.
Solution Approach 2:
The patent implements nested monitoring by containing individual process information within process sets, which are themselves nested within broader behavior patterns. This hierarchical structure allows the system to track nested process relationships (parent-child processes) and detect when concealed viruses embed themselves within legitimate process hierarchies.
3Productivity
If simple behavior monitoring is implemented, then monitoring overhead is low, but detection accuracy for complex malicious programs is insufficient
Solution Approach 1:
The patent extracts only the essential and suspicious elements from complete process information, creating compact process set representations. By extracting key identifiers (process IDs, parent-child relationships, associated files) and storing them in an optimized format, the system maintains low monitoring overhead while preserving sufficient information for accurate detection of complex malicious behaviors.
Data Source
AI summary
A method and an apparatus for detecting malicious behavior of a computer program are disclosed. The method and apparatus analyze behavior characteristics of a malicious program using the concept of a monitored process set. The method comprises: monitoring an action executed by the computer program; searching for a process set associated with the monitored action within a library of monitored process sets, the process set including information of suspicious processes correlated with each other in creating relationships; and if the process set associated with the monitored action is found, judging whether the monitored action belongs to malicious behavior by correlation analysis based on information recorded in the process set found.