Publisher Reputation Screening for Context-Aware Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious software applications lack the ability to derive the intent of a software publisher and evaluate functionality within a broader contextual framework, often failing to detect malware that utilizes legitimate operations for malicious intent.
Innovation Solution
A generative model, such as a transformer-based large language model, is used to derive context from a publisher's description and program code, comparing actual functionality against intended functionality to detect inconsistencies and interact with publishers to resolve issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus programs and manual review are used to detect malicious software, then legitimate software with encryption or obfuscation functionality can be approved, but malicious software using the same techniques for malicious intent cannot be distinguished and detected
Solution Approach 1:
The patent introduces a publisher profile as an intermediary element that mediates between the software code and the detection system. This profile contains metadata about the publisher's identity, reputation, and intended use, allowing the system to evaluate software in context rather than just analyzing code patterns. The publisher profile serves as a bridge that connects the software being reviewed with the publisher's track record and stated intentions, enabling differentiation between legitimate and malicious uses of the same techniques.
Solution Approach 2:
The patent adds a new dimension to software review by incorporating publisher context and reputation information alongside code analysis. Instead of relying solely on the traditional code-pattern-detection dimension, the system now evaluates software across multiple dimensions: code analysis, publisher identity, publisher reputation, and intended use. This multi-dimensional approach allows the system to distinguish between benign and malicious software that uses identical technical techniques.
2Reliability
If code obfuscation is used to protect trade secrets and improve security, then software security is enhanced, but malicious code can hide from detection
Solution Approach 1:
The patent requires publishers to provide information about their intended use and functionalities before software review, which is then stored in the publisher profile. This preliminary action establishes a baseline of expected legitimate behavior that can be used to evaluate the software later. By knowing in advance what the publisher claims the software is supposed to do, the review system can more effectively identify when obfuscated code deviates from legitimate purposes, even if the obfuscation techniques themselves are not directly detected.
3Reliability
If file encryption is used to protect sensitive user information, then data security is improved, but the same functionality can be utilized as ransomware to lock away user data
Solution Approach 1:
The patent implements a feedback mechanism where the review system compares the actual software functionalities against the publisher's stated intended use. When encryption functionality is detected in the software, the system checks whether this aligns with the publisher's declared purposes in their profile. If the encryption usage contradicts the stated intentions or matches patterns associated with ransomware, the system can flag the software for further review or rejection. This feedback loop allows the system to evaluate encryption usage in context rather than automatically blocking or approving based on the presence of encryption alone.
Data Source
AI summary
The techniques disclosed herein enable systems to leverage publisher profile and reputation to detect malware and block malicious actors. This is accomplished by obtaining a description of a software application that is pending release from the publisher. The description defines the nominal functionality of the software application such as expected program behaviors and device driver accesses. The system then catalogues the actual functionality of the software application by analyzing the program code implementing the software application. Accordingly, the generative model can detect inconsistencies between the actual functionality and the nominal functionality. In response, the generative model can initiate an interaction with the publisher to resolve the inconsistency. The publisher can respond with a justification of the inconsistency which is evaluated by the generative model in accordance with a reputation score associated with the publisher. The generative model optionally approves or blocks the software application based on the reputation score.