Real-Time Software Behavioral Pattern Recognition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security software faces delays and inaccuracies in identifying unknown software due to the rapid creation and modification of executable files, leading to false positives and false negatives, as existing methods struggle to recognize behavioral attributes in real-time.
Innovation Solution
A server-implemented method that traces runtime events of executable files, translates them into a high-level language, and generates a unique behavioral pattern, which is then distributed to client terminals for real-time identification of software as malicious or non-malicious, using API or subroutine calls, and kernel-based monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional security scanning methods are used to identify unknown software, then comprehensive analysis can be performed, but identification delays occur and real-time recognition is not achieved
Solution Approach 1:
The system performs preliminary action by pre-tracing runtime events of executable files and pre-translating them into high-level language patterns before actual security analysis is needed. These behavioral patterns are stored and ready for immediate comparison when software needs to be identified, eliminating the need for time-consuming real-time analysis while maintaining accurate identification.
2Device complexity
If static analysis methods are used to recognize software, then the analysis process is simple, but each modification to compiled software changes its static fingerprint making recognition unreliable
Solution Approach 1:
The system transitions from static analysis to dynamic behavioral analysis. Instead of relying on fixed static fingerprints that change with every compilation modification, the system traces actual runtime events and behavioral patterns of software execution. This dynamic approach captures the essential behavior of software regardless of static code changes, making recognition reliable even when software is modified.
3Object-affected harmful factors
If obfuscation methods are applied to software to protect it, then software security is improved, but security solutions based on scanners and emulators are evaded making detection difficult
Solution Approach 1:
The system uses an intermediary approach by introducing a behavioral translation layer that converts traced runtime events into high-level language patterns. This intermediary representation captures the essential behavior of software without being affected by obfuscation techniques. The patterns serve as a mediator between the obfuscated executable code and the security analysis system, enabling detection of obfuscated malware through its behavioral fingerprint rather than its static code.
4Productivity
If the rate of software installation increases exponentially, then more software is available, but the burden on security software to recognize unknown software increases making accurate identification difficult
Solution Approach 1:
The system creates behavioral pattern copies of traced runtime events that can be rapidly compared against new software. Instead of performing complex analysis on each new software installation, the system uses pre-created behavioral patterns as templates for quick matching. This copying approach allows the security system to keep pace with exponential software installation rates while maintaining accurate identification through pattern recognition.
Data Source
AI summary
A computer-implemented method for recognizing behavioral attributes of software in real-time is described. An executable file is executed. One or more runtime events associated with a behavior of the executable file are traced. The one or more traced runtime events are translated to a high level language. A recognizable pattern of the translated traced runtime events is produced. The pattern is a unique behavioral set of the translated traced runtime events.