Security Module Detecting Malware from Suspicious Hosts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting malware in computer systems are inefficient and resource-intensive, as they require monitoring all files for malicious activity, making it difficult to effectively identify and address security threats posed by malicious software.
Innovation Solution
A method and system that detect the arrival of files from potentially suspicious hosts, selectively track and monitor files from these hosts, and apply resource-intensive heuristics only to files from known or likely malicious sources, while exempting others from close scrutiny, using a security module that designates files from suspicious hosts as suspicious and tracks their behavior for malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional methods monitor all files for malicious activity, then detection coverage is improved, but system resource consumption increases
Solution Approach 1:
The patent applies local quality by differentiating monitoring intensity based on file characteristics. Files from suspicious hosts receive intensive monitoring with resource-intensive heuristics, while files from trusted hosts receive minimal or no monitoring. This selective approach maintains high detection coverage for malicious files while reducing overall system resource consumption by concentrating computational resources only where risk exists.
2Measurement precision
If resource-intensive heuristics are applied to all files, then detection precision is improved, but processing speed decreases
Solution Approach 1:
The patent implements partial action by applying resource-intensive heuristics only to a subset of files identified as suspicious based on host reputation and file characteristics. Instead of uniformly applying intensive analysis to all files, the system performs preliminary filtering to identify high-risk files, then applies precise detection methods only to those candidates. This maintains high detection precision for malicious files while preserving overall processing speed by avoiding unnecessary intensive analysis of benign files.
3Reliability
If all files are tracked and monitored, then security reliability is improved, but device complexity increases
Solution Approach 1:
The patent applies segmentation by dividing the file monitoring system into distinct layers: a first layer performs lightweight analysis on all incoming files using host reputation data, and a second layer applies resource-intensive heuristics only to files flagged as suspicious. This segmented approach maintains high security reliability by ensuring malicious files are caught in the second layer, while reducing system complexity by avoiding the need for intensive monitoring infrastructure across the entire file population.
Data Source
AI summary
A security module detects and remediates malware from suspicious hosts. A file arrives at an endpoint from a host. The security module detects the arrival of the file and determines the host from which the file arrived. The security module also determines whether the host is suspicious. If the host is suspicious, the security module observes the operation of the file and identifies a set of files dropped by the received file. The security module monitors the files in the set using heuristics to detect whether any of the files engage in malicious behavior. If a file engages in malicious behavior, the security module responds to the malware detection by remediating the malware, which may include removing system changes caused by the set.