Replica Database Malware Detection via Real-Time Stream Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware scanners are ineffective in detecting advanced malware, particularly injection-based or standalone malware, due to their inability to handle complex changes in malware signatures, leading to vulnerabilities in database security.
Innovation Solution
The system employs replica databases synchronized in real-time with a master database, where changes are analyzed by applying transformations such as normalization, de-serializing, and de-obfuscation to detect malware signatures, and executes remediation actions to remove malicious content, with hash value comparisons optimizing resource usage across replica databases.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional malware scanners use identical signature matching, then simple malware can be detected, but advanced malware with complex changes cannot be detected
Solution Approach 1:
The system applies multiple text transformations (normalization, de-serialization, de-obfuscation) to change the parameters of the scanned content, converting obfuscated and serialized malware into recognizable patterns that match security signatures, thereby enabling detection of advanced malware while maintaining detection of simple malware
Solution Approach 2:
The patent introduces transformation functions as intermediary processing steps between the original malware code and the signature matching process. These intermediaries (normalization, de-serialization, de-obfuscation layers) bridge the gap between obfuscated malware and detection signatures, allowing accurate detection without requiring direct identical matching
2Reliability
If full database scans are performed frequently, then malware detection reliability improves, but system performance and resource usage deteriorate
Solution Approach 1:
Instead of continuous full scanning, the system performs periodic scans triggered by specific events such as threshold numbers of changes detected in replica databases or scheduled intervals. This periodic action maintains detection reliability by scanning when changes occur while avoiding unnecessary continuous scanning that would degrade performance
Solution Approach 2:
The database scanning system is divided into multiple replica databases that can be scanned independently and in parallel. This segmentation allows the scanning workload to be distributed across multiple units, improving overall system performance while maintaining comprehensive coverage and detection reliability
3Reliability
If multiple replica databases are scanned independently, then detection coverage improves, but computational resource usage increases
Solution Approach 1:
The system merges the scanning operations across multiple replica databases by applying the same transformation and scanning process to all replicas. When a malware signature is detected in one replica, the same detection logic is applied to other replicas, combining efforts to achieve comprehensive coverage without independently re-scanning identical content, thereby reducing redundant computational resource usage
Data Source
AI summary
Disclosed herein are systems and method for detecting malware signatures in replica databases. In one exemplary aspect, a method includes identifying a plurality of replica databases corresponding to a master database. In response to detecting a change in at least one entry of a first replica database of the plurality of replica databases, the method includes analyzing the change for malware. In response to detecting malware, the method includes executing a remediation action to resolve the malware.