Executable Program Reputation Checking via Cloud Service
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Executable programs obtained from unknown sources pose a risk of infecting computers with viruses or malware, as users may unknowingly launch unsafe programs, and existing reputation checking methods are not effective at the time of program launch.
Innovation Solution
A computing device method that sends information about the executable program to a reputation service in the cloud or checks a local cache for safety verification before allowing program launch, displaying notifications if the program is identified as unsafe, potentially unsafe, or unknown.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If executable programs are obtained from unknown sources, then users gain access to diverse software options, but the risk of malware infection increases
Solution Approach 1:
The system performs reputation checking of executable programs before they are launched. When a user attempts to run a program, the system proactively queries a reputation service to determine if the program is safe, preventing malware execution before it can infect the system.
Solution Approach 2:
A reputation service acts as an intermediary between the user and executable programs. This service maintains a database of program reputations and provides safety verification, mediating the interaction between users and potentially harmful software from unknown sources.
2Reliability
If reputation checking is performed before program launch, then user safety is improved, but system response time increases
Solution Approach 1:
The system checks reputation information in advance before allowing program execution. This preliminary verification ensures safety by confirming the program's reputation status before it can be launched, preventing malware execution while maintaining user safety.
Solution Approach 2:
The system uses hash codes to create unique identifiers for executable programs. Instead of analyzing the entire program, the system generates a hash code from the program's binary data and uses this compact representation to query the reputation service, enabling efficient reputation checking.
3Measurement precision
If comprehensive reputation checking is implemented, then malware detection accuracy is improved, but system complexity increases
Solution Approach 1:
The system replaces complex manual malware analysis with automated reputation service queries. Instead of implementing sophisticated local analysis mechanisms, the system substitutes a simpler approach that leverages an external reputation service to provide accurate malware detection.
Solution Approach 2:
The system uses hash codes as simplified representations of executable programs. By converting complex program binaries into compact hash code identifiers, the system enables efficient and accurate reputation checking without requiring complex local analysis capabilities.
4Speed
If local cache is used for reputation information, then checking speed is improved, but information freshness decreases
Solution Approach 1:
The system pre-loads reputation information into a local cache before it is needed. When programs are installed or before launch, the system proactively retrieves and stores reputation data locally, so that subsequent reputation checks can be performed quickly without real-time network delays.
Solution Approach 2:
The system implements a caching mechanism that stores reputation information locally and uses it for rapid reputation checks. The cache provides feedback to the reputation checking process, enabling fast lookups while maintaining reasonable information freshness through periodic updates or validation.
Data Source
AI summary
The reputation of an executable computer program is checked when a user input to a computing device initiates a program launch, thus triggering a check of a local cache of reputation information. If the local cache confirms that the program is safe, it is permitted to launch, typically without notifying the user that a reputation check has been made. If the local cache cannot confirm the safety of the program, a reputation check is made by accessing a reputation service in the cloud. If the reputation service identifies the program as safe, it returns an indication to the computing device and the program is permitted to be launched, again without notifying the user that a reputation check has been made. If the reputation service identifies the program as unsafe or potentially unsafe, or does not recognize it at all, a warning is displayed to the user.