Reputation-Based Dynamic Sandboxing for Malware Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting computing systems from malware, such as sandboxing, often consume additional system resources and reduce application interoperability, necessitating a more efficient approach to safely execute untrusted programs.
Innovation Solution
Dynamic sandboxing of untrusted programs based on their reputation, where the system identifies and responds to the trustworthiness of executable files by sandboxing processes instantiated from them, intercepting and recording system changes, and providing virtual resources to isolate potential threats without affecting trusted processes or applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full-system sandboxing is applied to protect against malware, then security protection is improved, but system resource consumption increases and application interoperability deteriorates
Solution Approach 1:
The patent divides the sandboxing protection into segments: only untrusted processes are sandboxed while trusted processes run normally. The system segments processes based on reputation assessments, applying sandboxing selectively rather than system-wide, thereby reducing resource overhead while maintaining security for vulnerable processes
Solution Approach 2:
The patent implements dynamic sandboxing where the sandboxing state is not fixed but changes based on real-time reputation assessments. Processes can transition between sandboxed and unsandboxed states as their trustworthiness is reevaluated, allowing the system to adapt resource allocation dynamically rather than applying static full-system sandboxing
2Reliability
If full-system sandboxing is applied to protect against malware, then security protection is improved, but application interoperability deteriorates
Solution Approach 1:
The system segments applications into trusted and untrusted categories, applying sandboxing only to the latter. This segmentation preserves interoperability among trusted applications while maintaining security boundaries with untrusted ones, avoiding the blanket restriction that full-system sandboxing would impose on all applications
Solution Approach 2:
Different quality levels of protection are applied to different parts of the system: untrusted processes receive sandboxed isolation while trusted processes enjoy full interoperability. This local differentiation of security quality allows applications to interact freely when both are trusted, while still protecting against untrusted processes
Data Source
AI summary
A computer-implemented method for safely executing programs may include identifying an attempt to launch an executable file. The computer-implemented method may also include identifying a reputation associated with the executable file. The computer-implemented method may further include determining, based on the reputation, that the executable file is not trusted. The computer-implemented method may additionally include, in response to determining that the executable file is not trusted, fulfilling the attempt by sandboxing a process instantiated from the executable file. Various other methods, systems, and computer-readable media are also disclosed.