Sandbox-Based Program Installation Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus technologies are ineffective in preventing the installation and execution of undesirable programs, which can annoy users and consume system resources without providing benefits, and they often fail to reverse changes made by these programs.
Innovation Solution
A system that detects unknown programs, executes them in a secure environment, assesses their actions for undesirability, and prompts the user to allow or prohibit installation or execution based on weighted criteria, while allowing legitimate programs to install or execute without interference.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If current antivirus technologies are used to detect and remove undesirable programs, then detection capability is improved, but prevention capability deteriorates
Solution Approach 1:
The system performs preliminary analysis of programs during installation by executing them in a sandbox environment before they are fully installed on the user's system. This allows the system to detect undesirable behaviors in advance and prevent installation, rather than merely detecting and removing programs after installation.
Solution Approach 2:
A sandbox environment is introduced as an intermediary between the program being installed and the user's actual system. The program executes in this isolated intermediate environment, allowing safe observation of its behaviors without direct impact on the user's system.
2Measurement precision
If comprehensive monitoring of program actions is implemented, then detection accuracy is improved, but system complexity deteriorates
Solution Approach 1:
The monitoring system is segmented into distinct components: a sandbox environment for isolated execution, specific hooks for capturing particular system calls and events, and a analysis module for evaluating collected data. This modular segmentation reduces overall system complexity while maintaining comprehensive monitoring capability.
Solution Approach 2:
The system implements targeted monitoring with different levels of observation for different program behaviors. Critical actions such as file modifications, registry changes, and network communications are monitored with higher precision, while less critical behaviors receive lighter observation, optimizing the balance between detection accuracy and system complexity.
3Object-affected harmful factors
If programs are executed in a secure environment for analysis, then safety is improved, but processing time deteriorates
Solution Approach 1:
The system performs partial execution of programs in the sandbox, focusing on critical installation and initialization phases where undesirable behaviors most commonly occur. Rather than requiring complete program execution, the system analyzes sufficient portions to detect malicious patterns, reducing processing time while maintaining safety.
Solution Approach 2:
The system rapidly executes through critical program phases in the sandbox environment, using timeouts and resource limits to prevent excessive analysis time. Harmful actions are detected quickly during these rushed executions, and the system moves on without requiring full program completion.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Disclosed are systems and methods for controlling installation of programs on a computer. An exemplary system is configured to detect installation of an unknown program on a computer; suspend installation of the unknown program; execute the unknown program in a secure environment; detect undesirable actions of the unknown program, including: actions performed by the program without knowledge of a user, actions for accessing personal user data on the computer, and actions effecting user's working with other programs or operating system of the computer; determine whether the unknown program is undesirable or not based on the detected undesirable actions of the program; when the unknown program is determined be undesirable, prompt the user to select whether to allow or prohibit installation of the undesirable program on the computer; and when the unknown program is determined not to be undesirable, allow installation of the unknown program on the computer.