Software Trustworthiness Determination via Prevalence-Based Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware products impact client computer performance by continuously monitoring and analyzing files, often providing little benefit as they look for known malware on systems without it, leading to decreased performance and efficiency.
Innovation Solution
A method to determine software trustworthiness by receiving identification information from client computers, generating a list of files ordered by prevalence, capturing snapshots before and after installing software packages, comparing these snapshots to identify installed or modified files, and assigning trustworthiness levels to generate a report package, thereby reducing unnecessary monitoring and improving performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-malware products continuously monitor and analyze files using various assessment rules, then malware detection capability is improved, but client computer performance deteriorates
Solution Approach 1:
The system performs preliminary analysis of files across multiple client computers before individual assessment is needed. By collecting identification information and determining prevalence in advance, the system prepares assessment results that can be quickly applied when needed, reducing the computational burden during actual file access operations
Solution Approach 2:
The system enables client computers to contribute to the collective knowledge base by providing identification information about files they encounter. This self-service approach allows the network to automatically build and update its prevalence database without requiring centralized analysis of every file on every machine
2Measurement precision
If anti-malware products analyze files on every access using assessment rules, then detection accuracy is improved, but system efficiency deteriorates
Solution Approach 1:
The system merges assessment efforts across multiple client computers by collecting and analyzing identification information from the entire network. This collective approach maintains high detection accuracy through comprehensive analysis while improving efficiency by sharing results across the network, so individual computers don't need to perform redundant analysis
3Reliability
If anti-malware products look for known malware files, then malware detection capability is improved, but benefit to users without malware deteriorates
Solution Approach 1:
The system applies partial action by focusing monitoring and analysis resources only on files that exhibit certain characteristics or show signs of being malware. Rather than analyzing every file equally, the system identifies and concentrates resources on suspicious files based on identification information and prevalence data, reducing wasted computational effort on benign files
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
Aspects of the invention relate to a method, apparatus, and computer readable medium for determining software trustworthiness. In some examples, a software package identified as including at least one file of unknown trustworthiness is installed on a clean machine. A report package including a catalog of files that have been installed or modified on the clean machine by the software package is generated. Identification attributes for each of the files in the catalog is determined. Each of the files in the catalog is processed to assign a level of trustworthiness thereto. The report package is provided as output.