Stateful Model for Real-Time Malware Remediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current behavior-based malware detection systems face challenges in detecting malicious programs with changing behaviors and fail to trace sequences of non-malicious events that, when considered together, perform malicious actions, often requiring resource-intensive emulation in safe environments, which limits detection of potential behaviors and is not feasible in real-time for host machines with limited resources.
Innovation Solution
A computerized method and system that utilizes a stateful model to monitor and analyze operations in a live environment, building a logical data structure representing the operating system's composition and state, dividing objects into groups based on predefined rules, and generating a remediation plan to undo malicious operations, thereby restoring the system to a previous state before the malicious program's execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavior-based analysis is used to detect malware by monitoring actions, then detection capability is improved, but resource consumption increases and real-time detection in live environments becomes difficult
Solution Approach 1:
The system performs preliminary actions by building a stateful model that predicts future system states based on current operations. Instead of monitoring all behaviors in real-time, the model pre-computes expected state transitions and compares actual operations against these predictions, enabling efficient malware detection without exhaustive behavioral monitoring
Solution Approach 2:
The system creates a virtual copy of the system state through the stateful model, which simulates and predicts future states. This copying approach allows the system to analyze potential malicious behaviors in the virtual model without consuming resources to monitor every actual operation in the live environment
2Measurement precision
If comprehensive behavioral monitoring is implemented to trace sequences of events, then detection accuracy is improved, but system complexity and resource intensity increase
Solution Approach 1:
The system segments the complex task of behavioral monitoring into two distinct components: (1) building a stateful model that captures system state transitions, and (2) comparing actual operations against predicted transitions. This segmentation simplifies the overall system while maintaining detection accuracy by focusing computational resources on the most critical analysis tasks
3Reliability
If the system restores state by undoing operations, then system recovery effectiveness is improved, but time and resource consumption for remediation increase
Solution Approach 1:
The system performs preliminary actions by maintaining a stateful model that records the sequence of operations and their effects. When malware is detected, the system has already captured the necessary state information, enabling rapid restoration by reversing recorded operations without needing to perform extensive analysis or recovery procedures
Data Source
Figure 1a
Figure 1b
Figure 2
AI summary
There is provided a system and a computerized method of remediating one or more operations linked to a given program running in an operating system, the method comprising: querying a stateful model to retrieve a group of entities related to the given program; terminating at least a sub set of the group of entities related to the given program; generating a remediation plan including one or more operations linked to the given program, the one or more operations being retrieved based on the group in the stateful model; and executing the remediation plan by undoing at least part of the one or more operations linked to the given program thereby restoring state of the operating system to a state prior to the given program being executed. There is further provided a computerized method of detecting malicious code related to a program in an operating system in a live environment.