Software Security Checking Device Reducing False Positives
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The integration of third-party software packages in software applications poses a risk of malicious components, as existing methods often result in false positives due to checking individual features, leading to noise and reduced automation effectiveness in detecting malicious software.
Innovation Solution
A software security checking device with a rule database that associates software types with criteria based on features, using processors to ascertain software types and features, and determining maliciousness, with an output interface to block malicious software, and supporting Boolean and fuzzy logic rules for flexible detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If individual software features are checked independently for maliciousness, then the checking process is simple, but false positives increase and detection accuracy deteriorates
Solution Approach 1:
The patent combines multiple individual software feature checks into a unified rule-based evaluation system. Rules associate multiple software features with maliciousness criteria, evaluating software holistically rather than checking features in isolation. This merging approach reduces false positives by considering feature combinations and contexts that individual checks cannot capture.
Solution Approach 2:
The system changes the evaluation parameters from binary individual feature checks to multi-parameter rule-based assessment. Rules can incorporate multiple software features, thresholds, and logical conditions (Boolean and fuzzy logic) to determine maliciousness, transforming the detection approach from simple presence/absence checks to nuanced multi-dimensional evaluation.
2Reliability
If rigid Boolean rules are used for maliciousness detection, then the detection logic is clear and deterministic, but flexibility in handling ambiguous cases is reduced
Solution Approach 1:
The patent introduces dynamic rule evaluation by incorporating both Boolean and fuzzy logic. Boolean logic provides deterministic evaluation for clear-cut cases, while fuzzy logic enables flexible assessment of ambiguous situations. The system dynamically selects or combines logic types based on the specific rule and software characteristics, allowing consistent yet adaptable maliciousness detection.
Solution Approach 2:
The rule system combines different logic types (Boolean and fuzzy logic) into a composite evaluation framework. This composite approach allows the system to leverage the strengths of both deterministic Boolean evaluation and flexible fuzzy assessment, creating a hybrid rule engine that can handle both clear and ambiguous maliciousness cases effectively.
3Measurement precision
If comprehensive software analysis is performed to reduce false positives, then detection accuracy improves, but processing time and system complexity increase
Solution Approach 1:
The system performs preliminary classification by ascertaining software types before applying specific maliciousness rules. This preliminary action allows the system to narrow down the rule set based on software category, reducing the number of checks needed while maintaining comprehensive coverage. Type-specific rules can be applied more efficiently, reducing processing time without sacrificing detection accuracy.
Solution Approach 2:
The patent segments the maliciousness detection process into distinct phases: software type ascertainment, feature ascertainment, rule matching, and maliciousness determination. This segmentation allows each phase to be optimized independently, improving overall efficiency. By dividing the comprehensive analysis into manageable segments, the system reduces processing time while maintaining thorough evaluation.
Data Source
AI summary
A software security checking device. The device includes: a rule database with rules, each associated with at least one of a plurality of software types and contains a criterion in terms of software feature(s), the rule stating that a piece of software that fulfills the criterion is malicious; an input interface configured to receive a specification of a piece of software; processor(s) configured to ascertain one or more software types of the plurality of software types that the software possesses, to ascertain which of the software features the software possesses, ascertain, for each of the rules associated with at least one of the one or more ascertained software types, whether the criterion that the rule contains is fulfilled, and determine that the software is malicious in response to it being ascertained, for at least one rule, that the criterion it contains is fulfilled.