Spyware Detection via Module Prioritization and Honey Pot Processes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies fail to effectively detect and identify malware, particularly spyware and adware, which conceal themselves through techniques like DLL injection, making it difficult to distinguish between legitimate and malicious processes without user expertise.
Innovation Solution
A machine-implemented system that generates lists of modules loaded on a machine, filters out known legitimate modules, prioritizes suspicious ones based on occurrence, and uses a honey pot process to detect malware, along with resource consumption monitoring to identify potentially malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If comprehensive monitoring of all processes is implemented to detect malware, then detection capability is improved, but system complexity and resource consumption increase
Solution Approach 1:
The system segments the monitoring process into distinct functional components: a detection component that generates process lists and identifies suspicious modules, a filtering component that removes known legitimate modules using authentication lists, and a prioritization component that ranks threats. This segmentation allows comprehensive monitoring while managing system complexity through modular design.
Solution Approach 2:
The patent introduces authentication lists as intermediary data structures that mediate between the detection component and the filtering component. These lists contain pre-verified legitimate module information from trusted sources, enabling the system to efficiently filter out known good modules without requiring complex analysis of each module, thus reducing overall system complexity while maintaining detection accuracy.
2Measurement precision
If filtering out known legitimate modules is performed to reduce false positives, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system performs preliminary actions by pre-compiling authentication lists containing information about legitimate modules from trusted sources before the actual malware detection process. During detection, the system simply checks against these pre-prepared lists rather than performing complex analysis of each module in real-time, significantly reducing processing time while maintaining high detection accuracy.
3Productivity
If prioritization of suspicious modules is implemented to focus analyst attention, then remediation efficiency is improved, but system complexity increases
Solution Approach 1:
The prioritization component automatically performs self-service by analyzing the filtered list of suspicious modules and ranking them based on suspiciousness metrics without requiring manual intervention. The system uses occurrence data and pattern analysis to autonomously determine which modules warrant analyst attention, improving remediation efficiency while keeping the added complexity minimal through automated decision-making.
4Measurement precision
If honey pot processes are used to detect injected malware, then detection capability is improved, but system resource consumption increases
Solution Approach 1:
The honey pot processes are implemented with local quality by creating simplified, targeted versions of legitimate processes that possess only the specific characteristics needed to attract malware (such as appearing vulnerable to DLL injection). Rather than creating full-functional copies of complex applications, the honey pots have minimal resource footprints while maintaining their detection effectiveness, thus improving detection capability without proportionally increasing resource consumption.
Data Source
AI summary
A system and method that facilitates and effectuates detection of malware secreted and/or hidden in plain sight on a machine. The system and method in order to achieve its aims generates a list of all loaded modules, identifies from the list a set of modules common to more than a threshold number of processes, and eliminates from the list those modules included in an authentication list. The resultant list is prioritized based, in one instance, on the number of occurrences a particular module makes in the resultant list, and thereafter the list is distributed analyst workstations.