Software Identification via Behavioral Scoring and Signature Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security programs are ineffective in detecting malicious software applications due to their reliance on filename scans or file signatures, which can be evaded through polymorphism and other evasion techniques, making it difficult to identify and classify potentially harmful software.
Innovation Solution
A method that monitors software application instances by matching operations performed against pre-defined application signatures, with a scoring system to classify applications based on their behavior, allowing for dynamic and environment-specific actions to be taken, such as terminating or quarantining the application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If filename scans or file signatures are used for detection, then the detection method is simple to implement, but the detection effectiveness deteriorates due to polymorphism and evasion techniques
Solution Approach 1:
Instead of detecting malware by its static identity (filename, signature), the patent inverts the approach by detecting what the program is NOT - i.e., detecting legitimate program behavior and identifying anything that deviates from expected behavior patterns as potentially malicious
Solution Approach 2:
The patent changes the detection parameters from static file attributes (filename, hash signature) to dynamic operational parameters (operations performed, sequences of actions, behavior patterns), making detection resistant to polymorphism since the behavior signature remains consistent even when the file changes
2Reliability
If behavior monitoring with scoring system is implemented, then detection reliability improves, but device complexity increases
Solution Approach 1:
The patent segments the behavior monitoring into discrete, manageable components: individual operations are identified and assigned weights, sequences of operations are tracked independently, and scoring is performed modularly for each application, making the complex system easier to implement and maintain
Solution Approach 2:
The behavior monitoring system is designed to be universal, applying the same operation-tracking and scoring mechanism across all applications regardless of type or source, eliminating the need for separate detection systems for different threat types
Data Source
AI summary
Operations performed by a software application instance executed by a computing device are monitored. A determination is made that a particular operation performed matches an application signature representing a particular software application. In response, a match score is added to a total score for the software application. In response to determining that the total score is greater than or equal to a threshold, the software is classified.