Runtime Decoy for Blocking Unwanted Bundled Software
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current defensive techniques are insufficient in preventing the installation of unwanted adware and malware that often accompany legitimate software bundles, as they can be bypassed or require user intervention during the installation process, and are prone to errors.
Innovation Solution
The implementation of a system that detects and neutralizes unwanted software by creating a decoy in memory to divert illegitimate code and using morphing techniques to randomize library addresses, ensuring legitimate code can execute while blocking malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If automatic unchecking of bundled software checkboxes is used during installation, then user protection against unwanted software is improved, but the system is prone to errors such as changing checkbox labels and locations, and fails when users have no option to reject bundled software
Solution Approach 1:
The patent performs preliminary analysis of the installer executable file before the installation process begins. The system extracts and analyzes code segments, identifies bundled software components, and determines their locations and characteristics in advance. This preliminary action allows the defensive system to prepare countermeasures before the installer actually presents checkboxes to the user, making the protection more reliable and less prone to errors during the installation process.
Solution Approach 2:
The patent introduces an intermediary analysis layer between the user and the installer. Instead of directly interacting with checkboxes during installation (which is prone to errors), the system inserts an intermediate step that analyzes the installer file, identifies unwanted components, and prepares a blocklist. This intermediary approach decouples the protection mechanism from the volatile installation interface, significantly improving reliability.
2Ease of operation
If users are given the option to opt-out of bundled installers during installation, then ease of operation is improved, but users typically choose to stay with default settings, resulting in unwanted software installation
Solution Approach 1:
The patent applies preliminary anti-action by analyzing the installer file before installation and identifying unwanted bundled software components in advance. The system creates a blocklist of these components and prepares to intercept their installation attempts. This preliminary protective action occurs before the user is presented with any opt-out options, effectively countering the harmful bundled installation before it can exploit user inattention or confusion during the installation process.
3Reliability
If sophisticated defensive techniques are used to detect malware, then protection effectiveness is improved, but these techniques can be bypassed by sophisticated malware and adware
Solution Approach 1:
The patent performs preliminary static analysis of the installer executable file before the installation process begins and before malware can execute or evade detection. By extracting and analyzing code segments, identifying bundled software, and creating a blocklist in advance, the system establishes protection before the malware has a chance to adapt or bypass defensive measures during runtime.
Solution Approach 2:
The patent creates a copy or representation of the installer's code structure and behavior through static analysis. By analyzing the executable file and creating a model of its installation process, including identifying bundled components and their characteristics, the system can detect and block unwanted software without needing to execute the actual installer. This copying approach allows detection of sophisticated malware patterns without triggering evasion mechanisms.
4Object-affected harmful factors
If the system blocks all bundled software installation, then protection against unwanted software is improved, but legitimate bundled software installation is also prevented
Solution Approach 1:
The patent applies local quality by treating different bundled software components differently based on their identified characteristics. The system analyzes each bundled component individually, determining whether it is legitimate or unwanted based on its code structure, publisher information, and other local attributes. This granular, location-specific approach allows the system to block only the harmful components while permitting legitimate bundled software to install normally, thus maintaining productivity while protecting against threats.
Data Source
AI summary
Embodiments described herein are capable of preventing the installation of unwanted software bundled with a desired application at runtime, while allowing the installation of the desired application to continue as expected. For example, the embodiments described herein create a decoy in memory that preempts unwanted code. The decoy attracts any illegitimate code and diverts it into a dead end (e.g., the code is isolated, thereby preventing it from properly executing), while installation of the legitimate code (i.e., the desired application) flows as expected. The foregoing detects that a reflective loading process of DLL associated with the unwanted application has occurred, identifies the entity that attempted to perform the reflective loading process, and prevents the entity from completing the reflective loading process without terminating the main installer. That is, the main installer will continue as usual (and install the desired application) while the installation of the unwanted application is blocked.