Software Trustworthiness Detection via Prevalence and Reputation Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting software threats, such as advanced persistent threats and rootkits, often result in false positives and fail to accurately identify malware due to their sophisticated nature and ability to evade traditional scanning mechanisms.
Innovation Solution
A system and method that combines prevalence data from a local network with reputation data and malware deep scan results to determine the trustworthiness of software programs, using a prevalence score and reputation score to assess potential threats and perform appropriate security actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional scanning mechanisms are used to detect malware, then detection speed is maintained, but detection accuracy deteriorates due to false positives and inability to identify sophisticated threats like APTs and rootkits
Solution Approach 1:
The patent combines multiple detection approaches (prevalence analysis, reputation scoring, and deep scanning) into a unified detection system. This integration allows the system to leverage the speed of prevalence-based filtering while incorporating the accuracy of deep scanning only when necessary, thereby improving overall detection accuracy without proportionally increasing system complexity
Solution Approach 2:
The detection process is segmented into multiple stages: first, prevalence-based filtering is applied to quickly eliminate obviously safe software; second, reputation scoring is used to assess remaining programs; and third, deep scanning is performed only on programs that fail previous checks. This segmentation reduces false positives and improves detection accuracy while maintaining efficient processing
2Reliability
If white lists and application inventories are used to identify safe software, then false positives are reduced, but legitimate unique software programs are incorrectly blocked
Solution Approach 1:
The patent dynamically adjusts the prevalence threshold parameter based on the specific context and type of software being evaluated. For organization-unique programs, the system recognizes that low prevalence is expected and adjusts the threshold accordingly, preventing false positives while maintaining reliability for detecting actually suspicious software with appropriately adjusted parameters
3Measurement precision
If deep scanning is performed on all software programs, then detection accuracy is improved, but processing time and system resources increase significantly
Solution Approach 1:
Instead of performing deep scanning on all software programs, the patent applies deep scanning only partially—to programs that fail the prevalence and reputation checks. This selective approach maintains high detection accuracy for potentially malicious software while avoiding the time and resource costs of scanning every program, thereby resolving the contradiction between detection accuracy and processing time
Data Source
AI summary
A computer-implemented method for determining trustworthiness of software programs may include (1) determining, for at least one software program, a prevalence score that indicates a prevalence of the software program within a local network, (2) obtaining, for the software program, a reputation score that indicates a reputation of the software program, (3) determining a trustworthiness of the software program based on both the reputation score of the software program and the prevalence score of the software program, and (4) performing a security action based on the trustworthiness of the software program. Various other methods, systems, and computer-readable media are also disclosed.