Retroactive Malware Detection via Metadata Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware systems face challenges in efficiently retroactively detecting malicious software on end-user systems and correcting false positives without incurring high computational costs, as they often require expensive cross-referencing of tens of thousands of files against new signatures.
Innovation Solution
A client-server system that extracts metadata from files, cross-references it against intelligence gathered by a server, and takes appropriate actions based on updated classifications, allowing for retroactive detection and remediation of malicious software without direct endpoint processing, using components like metadata extraction, logging, intelligence gathering, cross-referencing, and policy enforcement modules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing anti-malware systems perform cross-referencing of files against new signatures to retroactively detect malicious software, then detection accuracy is improved, but computational cost and processing time increase significantly
Solution Approach 1:
The patent extracts only the essential identifying features (signatures, hashes, metadata) from files rather than performing complete file analysis. By extracting and storing these key identifiers locally and comparing them against threat intelligence feeds, the system achieves retroactive detection without the high computational cost of full cross-referencing of all files against all signatures.
Solution Approach 2:
The system performs preliminary extraction of file metadata and signatures when files are first encountered or added to the system, storing this information in advance. This preliminary action enables rapid retroactive detection later without requiring expensive real-time computation, as the comparison data is already prepared and stored locally.
2Reliability
If anti-malware vendors continuously update threat signatures to detect new malware, then security protection is improved, but the complexity of maintaining and distributing updates increases
Solution Approach 1:
The patent introduces a local threat intelligence cache as an intermediary between the central vendor signature database and the endpoint system. This intermediary stores locally the most recent signatures and threat intelligence, allowing the system to maintain up-to-date security protection without requiring complex real-time update distribution mechanisms. The intermediary simplifies update management by decoupling the frequency of vendor updates from the availability of protection at endpoints.
3Reliability
If the system scans all files on an end-user system to retroactively detect malware, then comprehensive detection is improved, but processing time and system performance degradation increase
Solution Approach 1:
The system extracts and compares only critical identifying features (signatures, hashes, metadata) rather than performing comprehensive full-file scanning. This extraction approach maintains comprehensive detection capability by comparing against all relevant threat indicators while reducing processing time to minutes or seconds instead of hours, as only key identifiers need to be matched rather than entire files analyzed.
4Speed
If the system maintains local copies of all threat signatures for rapid comparison, then detection speed is improved, but storage requirements increase
Solution Approach 1:
The system extracts and stores only the essential signature data and metadata locally rather than maintaining complete copies of all threat signature databases. By storing only the critical identifying features and comparison data needed for retroactive detection, the system achieves rapid detection speed through local comparison while keeping storage requirements manageable, avoiding the need to store entire signature databases at each endpoint.
Data Source
AI summary
A system retroactively detects malicious software on an end user system without performing expensive cross-referencing directly on the endpoint device. A client provides a server with information about files that are on it together with what it knows about these files. The server tracks this information and cross-references it against new intelligence it gathers on clean or malicious files. If a discrepancy in found (i.e., a file that had been called malicious, but that is actually benign or vice versa), the server informs the client, which in turn takes an appropriate action based on this information.