Shadow File Detection of Malicious Code Modifications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional antivirus products face delays in detecting new malicious codes, leading to propagation and potential system corruption, with high false alarm rates and risks of system crashes due to incomplete or buggy clean patterns.
Innovation Solution
A method that creates a shadow file to represent the original file's modifications before they are committed, allowing for a comprehensive comparison to determine if the modifications are made by malicious codes, thereby preventing harmful changes to the original file.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature matching is used to detect malicious codes, then detection accuracy is improved, but detection speed deteriorates due to delays in obtaining signatures
Solution Approach 1:
The system creates shadow files in advance that represent the original files before malicious modification. These shadow files are prepared beforehand so that when a file modification is detected, the comparison can immediately occur without waiting for signature updates, thus performing the detection action in advance
Solution Approach 2:
The patent creates shadow files as copies of the original files. These shadow files serve as reference versions that can be immediately compared against modified files, eliminating the need to wait for signature database updates while maintaining accurate detection capability
2Productivity
If behavior blocking is used to detect malicious codes, then detection speed is improved, but false alarm rate increases
Solution Approach 1:
The shadow file acts as an intermediary reference between the original file and the modified file. Instead of directly blocking based on behavior analysis alone, the system uses the shadow file as a mediator for comparison, providing objective evidence to confirm whether modifications are malicious, thus reducing false alarms while maintaining fast detection
Solution Approach 2:
The system implements feedback by comparing the modified file against the shadow file and using the comparison results to determine whether to block the modification. This feedback mechanism allows the system to verify suspicious behaviors against a known good state, reducing false positives while maintaining rapid response
3Measurement precision
If clean patterns are created manually to disinfect files, then detection accuracy is improved, but time loss increases during pattern creation
Solution Approach 1:
The shadow files are created in advance as the clean reference patterns, eliminating the need for manual pattern creation after infection is detected. The clean state is captured beforehand, so when infection occurs, the comparison can immediately proceed without waiting for researcher analysis and pattern development
Solution Approach 2:
The shadow files serve as automated copies of the clean original files. Instead of requiring manual creation of clean patterns by researchers, the system automatically maintains shadow file copies that can be immediately used for comparison and disinfection guidance
4Manufacturing precision
If manual clean pattern creation is used, then manufacturing precision is improved, but device complexity increases
Solution Approach 1:
The system performs self-service by automatically maintaining shadow files and performing comparisons without requiring manual intervention from researchers. The antivirus system itself generates and manages the clean reference patterns through automated shadow file creation and comparison, reducing the need for external expert analysis
Data Source
AI summary
File modifications performed by malicious codes are detected by detecting a file modification for an original file before the file modification is performed on the original file. In response to detecting the file modification, a corresponding shadow file is created. The shadow file represents the original file as modified by the file modification. Before allowing the file modification to be performed on the original file, the original file is compared to the shadow file to determine if the file modification is being performed by malicious codes. The file modification may be deemed to be performed by malicious codes when the file modification involves, for example, entry point append, entry point prepend, entry point obfuscation, cavity, overwriting, or mal-tattoo.