Remote Malicious File Remediation via WMI Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malicious file detection systems often fail to rapidly identify and remediate malicious files during download, allowing them to execute and cause damage before complete analysis is performed, due to significant processing resource requirements and difficulties in sandboxing on client devices.
Innovation Solution
A security device uses remote access via tools like Windows Management Instrumentation (WMI) to obtain low-level access to the client device, allowing for rapid detection, information gathering, and execution of remediation actions, such as disabling network adapters or deleting files, to mitigate malicious file threats before significant damage occurs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If malicious file detection is performed during download, then detection speed is improved, but processing resource requirements increase
Solution Approach 1:
The patent uses a security device as an intermediary to perform malicious file detection during the download process. This external security device handles the resource-intensive analysis separately from the client device, enabling rapid detection without overburdening the client's processing resources. The security device intercepts the download stream and performs analysis in parallel with the download process.
2Measurement precision
If complete analysis is performed before file execution, then detection accuracy is improved, but response time deteriorates
Solution Approach 1:
The patent performs preliminary malicious file detection during the download process itself, before the file is fully downloaded or executed. The security device analyzes the file stream in real-time, identifying malicious content early in the download process. This preliminary action enables rapid response by stopping the download or alerting the user before the malicious file can execute, achieving both speed and accuracy.
3Adaptability or versatility
If sandboxing is implemented on client device, then detection capability is improved, but device complexity increases
Solution Approach 1:
The patent extracts the sandboxing and advanced detection capabilities from the client device and relocates them to a dedicated security device. This separation allows the security device to implement complex sandboxing environments and sophisticated analysis techniques without increasing the complexity of the client device. The client device simply interacts with the security device through standard interfaces.
4Reliability
If remote access is obtained for remediation, then remediation effectiveness is improved, but access security requirements increase
Solution Approach 1:
The patent implements a feedback mechanism where the security device monitors and controls remote access to the client device. The system continuously assesses the security context and only permits remediation actions when verified necessary and safe. This feedback loop ensures that remote access is granted selectively, maintaining security while enabling effective remediation when malicious files are detected.
Data Source
AI summary
A device may determine that a file of a client device is a malicious file. The device may obtain remote access to the client device using a connection tool. The connection tool may provide access and control of the client device. The remote access may include access to a file location of the malicious file. The device may determine file information associated with the malicious file using the remote access to the client device. The device may select one or more remediation actions based on the file information. The device may cause the one or more remediation actions to be executed using the remote access to the client device.