Scoring Engine for Malware Detection via Entity Propagation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods are ineffective against evolving malware threats that employ obfuscation techniques and divide malicious activities among multiple agents, making it difficult to detect and prevent malware infections.
Innovation Solution
A host system comprising a processor configured to execute an entity management module, an entity evaluator, and a scoring engine that manages and evaluates software entities, propagates scores across related entities, and determines maliciousness based on aggregated evaluation criteria, thereby enhancing detection capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional malware detection methods are used, then detection simplicity is maintained, but detection effectiveness deteriorates against evolving malware threats
Solution Approach 1:
The patent combines multiple evaluation criteria (behavioral analysis, code characteristics, heuristic evaluation) into a unified scoring system that aggregates results from various detection methods. This merging approach maintains comprehensive detection effectiveness while presenting a single integrated evaluation result to users, resolving the contradiction between detection reliability and system complexity.
Solution Approach 2:
The scoring engine is designed to evaluate multiple types of entities (malware samples, suspicious processes, network connections) using a universal scoring framework. This multi-functional approach allows the system to handle diverse malware threats with a single detection mechanism, improving reliability without proportionally increasing complexity.
2Measurement precision
If score propagation across related entities is implemented, then detection accuracy improves, but computational overhead increases
Solution Approach 1:
The system pre-establishes entity relationship maps and evaluation criterion frameworks before actual malware analysis. By preparing the scoring structure and relationship data in advance, the system reduces real-time computational overhead when propagating scores across entities, thus improving detection precision without excessive resource consumption during active scanning.
Solution Approach 2:
The scoring mechanism dynamically adjusts propagation depth and intensity based on initial evaluation results. When a entity shows suspicious characteristics, the system intensively propagates scores to related entities; when entities appear benign, propagation is limited. This dynamic approach optimizes the balance between detection precision and computational resource usage.
Data Source
AI summary
Described systems and methods allow protecting a computer system from malware such as viruses, Trojans, and spyware. For each of a plurality of executable entities (such as processes and threads executing on the computer system), a scoring engine records a plurality of evaluation scores, each score determined according to a distinct evaluation criterion. Every time an entity satisfies an evaluation criterion (e.g, performs an action), the respective score of the entity is updated. Updating a score of an entity may trigger score updates of entities related to the respective entity, even when the related entities are terminated, i.e., no longer active. Related entities include, among others, a parent of the respective entity, and/or an entity injecting code into the respective entity. The scoring engine determines whether an entity is malicious according to the plurality of evaluation scores of the respective entity.