Security Software Installation Obfuscation Against Malware Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious computer programs (malware) can prevent security software from installing by targeting and blocking executable files and services associated with the security software, thereby avoiding detection and removal.
Innovation Solution
A system and method that detects malicious attempts to block security software installation by identifying affected executable files or services and dynamically obfuscates them through renaming, modifying installation paths, creating symbolic links, copying, or removing digital certificates, while also neutralizing the security threat and restoring original states.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security software uses standard executable files with known names and paths, then the software can be easily identified and managed, but malicious malware can detect and block these files to prevent installation
Solution Approach 1:
The patent applies dynamics by making executable file names and paths changeable rather than static. The security software dynamically generates random suffixes for executable file names and uses dynamic link library (DLL) hijacking to redirect calls to obfuscated locations. This dynamic behavior prevents malware from reliably predicting or blocking file names, as the actual file identities change during installation and execution.
Solution Approach 2:
The patent uses DLL hijacking as an intermediary mechanism to decouple the actual executable file locations from the names and paths that the system and user interact with. By placing malicious-looking DLLs in strategic locations, the software creates a layer of indirection that redirects execution to legitimate files, thereby obscuring the true file identities from malware that monitors standard file paths.
2Object-affected harmful factors
If security software obfuscates executable file names and paths to evade malware, then malware blocking is prevented, but system and user identification of the software becomes difficult
Solution Approach 1:
The patent applies local quality by differentiating between how different components interact with the executable files. The malware detection component benefits from obfuscated file names and dynamic paths, while the user interface and system management components maintain access to original file identities through alternative mechanisms such as registry entries, configuration files, or metadata storage. This allows each component to access the information most suitable for its function.
Solution Approach 2:
The patent segments the file identification system into multiple layers: the actual executable files use obfuscated names and dynamic paths for protection, while separate configuration structures (such as registry keys, configuration files, or metadata databases) maintain the mapping between obfuscated names and original identities. This segmentation allows the system to simultaneously achieve obfuscation for security and maintainability for management.
3Reliability
If security software dynamically obfuscates executable files during installation, then malware cannot block the installation, but the installation process becomes more complex
Solution Approach 1:
The patent applies preliminary action by pre-generating pools of random suffixes and pre-identifying potential DLL hijacking locations during the software packaging phase. These preparations are made before installation, so that during the actual installation process, the system only needs to select from pre-approved options and execute predetermined redirection logic, rather than generating all obfuscation elements in real-time. This reduces the computational complexity and time required during installation.
Solution Approach 2:
The patent changes parameters such as file name suffixes and installation paths in a controlled manner using systematic algorithms. Rather than arbitrary complexity, the obfuscation follows structured rules (e.g., appending random alphanumeric suffixes, using hash-based path generation) that maintain consistency and predictability for the security software while appearing random to malware. This parameter-based approach simplifies the implementation compared to fully arbitrary obfuscation.
Data Source
AI summary
Computer-implemented methods and systems for circumventing malicious attempts to block the installation of security-software programs are disclosed. An exemplary method for performing such a task may comprise: 1) detecting, during installation of a security-software program, an error that is indicative of an attack on the security-software program, 2) identifying at least one executable file targeted by the attack on the security-software program, 3) circumventing the attack by dynamically obfuscating the executable file targeted by the attack, and then 4) completing installation of the security-software program.