Reputation Indicator for Optimized Anti-Malware Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems face significant computational burdens due to the complexity of malware detection routines, signature databases, and behavior heuristics, which are not effectively scalable to address newly discovered malware threats.
Innovation Solution
A system that utilizes a client-server architecture to determine a process reputation indicator based on the reputation of its executable modules, allowing for a targeted and optimized anti-malware scan by transmitting module reputation indicators between a server and client systems, enabling the configuration of anti-malware scans according to the likelihood of a process being malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional malware detection methods (signature matching, behavior heuristics) are used, then detection capability is improved, but computational burden increases significantly
Solution Approach 1:
The system segments malware detection into two independent components: module-level reputation assessment and process-level behavior analysis. By evaluating individual executable modules separately and combining their reputations, the system reduces the computational complexity of analyzing entire processes while maintaining detection accuracy.
Solution Approach 2:
The system performs preliminary reputation assessment of executable modules before full process analysis. Module reputation indicators are pre-computed and stored, allowing the system to quickly filter suspicious processes without performing complete behavioral analysis on every process, thereby reducing overall computational burden.
2Measurement precision
If comprehensive malware detection routines are implemented, then detection accuracy is improved, but system performance deteriorates
Solution Approach 1:
The system applies different analysis depths to different processes based on their module composition. Processes containing modules with low reputation scores undergo more rigorous analysis, while those with high-reputation modules receive lighter scrutiny. This localized quality approach maintains high detection accuracy for suspicious processes while preserving system performance for benign ones.
Solution Approach 2:
The system dynamically adjusts detection parameters based on module reputation indicators. When a process contains modules with suspicious reputation scores, the system increases detection sensitivity and analysis depth. For processes with clean module reputations, detection parameters are relaxed, maintaining accuracy while improving performance.
3Productivity
If optimization procedures are applied to reduce computational costs, then system efficiency is improved, but adaptability to new malware decreases
Solution Approach 1:
The system continuously updates module reputation indicators based on feedback from detected malware behaviors and security events. When new malware patterns are identified, the system adjusts module reputations and detection thresholds accordingly, maintaining adaptability to emerging threats while preserving the efficiency gains from reputation-based optimization.
Solution Approach 2:
The module reputation system is dynamic and adaptable rather than static. Reputation scores are continuously updated based on new security intelligence, allowing the system to adapt to newly discovered malware while maintaining the computational efficiency provided by reputation-based prioritization.
4Reliability
If full anti-malware scans are performed on all processes, then detection completeness is improved, but processing time increases
Solution Approach 1:
The system performs partial scans on processes with high-reputation modules, focusing computational resources only on suspicious components. Full scans are reserved for processes containing modules with low reputation indicators. This partial action approach maintains detection completeness for malicious processes while dramatically reducing processing time for benign ones.
Solution Approach 2:
The system performs preliminary filtering based on module reputation indicators before initiating full scans. Processes are pre-assessed and categorized into scan priority levels, allowing the system to quickly identify and focus on suspicious processes while skipping or lightly scanning benign ones, thereby reducing overall processing time without compromising detection completeness.
Data Source
Figure 1~2
Figure 3-A~4
Figure 5~6
AI summary
Described systems and methods allow protecting a computer system from malware, such as viruses, Trojans, and spyware. A reputation manager executes in conjunction with an anti- malware engine. The reputation manager determines a reputation of a target process executing on the computer system according to a reputation of a set of executable modules, such as shared libraries, loaded by the target process. The anti-malware engine may be configured to employ a process-specific protocol to scan the target process for malware, the protocol selected according to process reputation. Processes trusted to be non-malicious may thus be scanned using a more relaxed protocol than unknown or untrusted processes. The reputation of executable modules may be static; an indicator of module reputation may be stored and/or retrieved by a remote reputation server. Process reputation may be dynamically changeable, i.e. re-computed repeatedly by the reputation manager in response to process life-cycle and/or security events.