Windows Registry Entry Hashing for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting unauthorized changes to the Windows registry efficiently to prevent malware modifications, which requires significant storage and computing resources due to the large number of registry entries and potential malware programs.
Innovation Solution
Generating identifiers based on registry entries using hashing or filtering algorithms, packaging these identifiers, and sending them to client software like anti-malware programs for verification, allowing for efficient detection of undesirable changes before they become effective.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-malware software verifies all registry changes to prevent unauthorized modifications, then security against malware is improved, but system resources (storage and computing) are significantly consumed
Solution Approach 1:
The patent extracts only the essential identifying features of registry entries (first portion containing key information) rather than verifying entire registry entries. This extraction approach reduces the data volume requiring verification while maintaining security effectiveness, directly addressing the resource consumption problem.
Solution Approach 2:
The patent transforms registry entry data into hash values, changing the parameter representation from raw registry data to compressed hash identifiers. This parameter transformation significantly reduces storage requirements and computing resources needed for verification while preserving the ability to detect unauthorized changes.
2Measurement precision
If anti-malware software monitors all registry entries to detect unauthorized changes, then detection accuracy is improved, but the complexity of the verification system increases
Solution Approach 1:
The patent segments registry entries into two portions: a first portion containing identifying information used for hash generation, and a second portion containing other data. This segmentation allows the system to focus verification efforts on the critical identifying portion, maintaining detection accuracy while simplifying the overall verification process.
Solution Approach 2:
The patent creates hash value copies of registry entry identifiers rather than storing or processing the actual registry entries. These hash copies serve as simplified representations that maintain detection capability while reducing system complexity and resource requirements.
3Reliability
If the system stores and processes complete registry entries for verification, then verification reliability is improved, but storage requirements increase significantly
Solution Approach 1:
The patent transforms registry entry parameters into hash values, changing the data representation from full registry entries to compressed identifier forms. This parameter change dramatically reduces storage requirements while preserving verification reliability through the use of cryptographic hash functions that maintain data integrity.
Solution Approach 2:
The patent extracts only the essential identifying portion of registry entries for hash generation and storage, separating this critical information from the rest of the registry data. This extraction approach minimizes storage requirements while maintaining the ability to reliably detect unauthorized changes.
Data Source
AI summary
A method and system is provided by which unauthorized changes to the registry may be detected and that provides the capability to verify whether registry, or other system configuration data, changes that occur on a computer system are undesirable or related to possible malware attack before the changes become effective or are saved on the system. A method for verifying changes to system configuration data in a computer system includes generating an identifier representing an entry in the system configuration data, packaging the identifier, and sending the packaged identifier to a client for verification. The identifier may be generated by hashing the first portion of the entry and the second portion of the entry to generate the identifier, or by filtering the first portion of the entry and hashing the filtered first portion of the entry and the second portion of the entry to generate the identifier.