Proxy Server Emulated OS Malware Detection

Solution Overview

Problem

Current methods for restricting processing systems from malware threats, such as signature-based detection and code-signing, are inadequate as they fail to detect new variants of malware and do not ensure the software's non-malicious nature, respectively.

Innovation Solution

A method and system utilizing a proxy server with emulated operating systems to monitor and analyze downloaded data for malicious behavior, including the use of a cache module, hash values, and analysis modules like cryptographic hash, checksum, and pattern matching to identify and restrict threats.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If signature-based detection is used, then known malware can be detected, but new variants of malware cannot be detected

Engineering Contradiction:

Improvemalware detection capabilityVSAvoiddetection coverage for new malware variants

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system performs preliminary analysis of downloaded software by executing it in a virtualized environment before it reaches the user's system. This preliminary action allows the system to detect malicious behavior patterns and restrict access to potentially harmful software, addressing both known and unknown malware variants through proactive analysis rather than reactive signature matching.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces a proxy server with virtualized operating systems as an intermediary between the user and the downloaded software. This intermediary layer analyzes software behavior in isolation, preventing direct execution on the user's system while maintaining detection capability for both known and novel malware through behavioral analysis rather than relying solely on signatures.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If code-signing is used, then software vendor trust can be verified, but the downloaded software cannot be analyzed for malicious content

Engineering Contradiction:

Improvesoftware vendor trust verificationVSAvoiddetection of malicious content

Core Design Contradiction:

ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The system performs preliminary behavioral analysis of downloaded software in a virtualized environment before allowing execution on the user's system. This preliminary action enables the system to detect malicious content by observing actual behavior patterns, such as file system modifications, network connections, and process creation, regardless of the software's code-signing status.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces a proxy server with virtualized operating systems as an intermediary layer that sits between the user and downloaded software. This intermediary maintains vendor trust verification through code-signing while simultaneously enabling comprehensive behavioral analysis to detect malicious content, resolving the contradiction by adding an additional analysis layer without compromising the trust verification mechanism.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Productivity

If traditional malware detection methods are used, then processing speed is maintained, but detection accuracy for new threats is insufficient

Engineering Contradiction:

Improveprocessing speedVSAvoiddetection accuracy

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The system performs preliminary analysis of downloaded software by executing it in a virtualized environment before it reaches the user's system. This preliminary action allows the system to detect malicious behavior patterns and restrict access to potentially harmful software, addressing both known and unknown malware variants through proactive analysis rather than reactive signature matching.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces a proxy server with virtualized operating systems as an intermediary between the user and the downloaded software. This intermediary layer analyzes software behavior in isolation, preventing direct execution on the user's system while maintaining detection capability for both known and novel malware through behavioral analysis rather than relying solely on signatures.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS8887278B2Restricting a processing system being compromised with a threat

Publication Date: 2014.11.11 GEN DIGITAL INC

AI summary

A method, system, computer readable medium of instructions and/or computer program product. The method comprises receiving, in a proxy server, response data from a remote processing system, according to a request from the client processing system to download data from the remote processing system; using, in one or more emulated operating systems of the proxy server, the downloaded data; monitoring behavior of the use of the data in the one or more emulated operating systems; and in response to detecting malicious behavior indicative of a threat, restricting the client processing system being compromised with the threat of the response data.