Stateful Model for Real-Time Malware Remediation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current behavior-based malware detection systems face challenges in detecting malicious programs with changing behaviors and fail to trace sequences of non-malicious events that, when considered together, perform malicious actions, often requiring resource-intensive emulation in safe environments, which limits detection of potential behaviors and is not feasible in real-time for host machines with limited resources.

Innovation Solution

A computerized method and system that utilizes a stateful model to monitor and analyze operations in a live environment, building a logical data structure representing the operating system's composition and state, dividing objects into groups based on predefined rules, and generating a remediation plan to undo malicious operations, thereby restoring the system to a previous state before the malicious program's execution.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If behavior-based analysis is used to detect malware by monitoring actions, then detection capability is improved, but resource consumption increases and real-time detection in live environments becomes difficult

Engineering Contradiction:
Improvemalware detection capabilityVSAvoidresource consumption
Core Design Contradiction:
ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system performs preliminary actions by building a stateful model that predicts future system states based on current operations. Instead of monitoring all behaviors in real-time, the model pre-computes expected state transitions and compares actual operations against these predictions, enabling efficient malware detection without exhaustive behavioral monitoring

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The system creates a virtual copy of the system state through the stateful model, which simulates and predicts future states. This copying approach allows the system to analyze potential malicious behaviors in the virtual model without consuming resources to monitor every actual operation in the live environment

Inventive Principle:
Principle #26Copying

2Measurement precision

If comprehensive behavioral monitoring is implemented to trace sequences of events, then detection accuracy is improved, but system complexity and resource intensity increase

Engineering Contradiction:
Improvedetection accuracyVSAvoidsystem complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The system segments the complex task of behavioral monitoring into two distinct components: (1) building a stateful model that captures system state transitions, and (2) comparing actual operations against predicted transitions. This segmentation simplifies the overall system while maintaining detection accuracy by focusing computational resources on the most critical analysis tasks

Inventive Principle:
Principle #1Segmentation

3Reliability

If the system restores state by undoing operations, then system recovery effectiveness is improved, but time and resource consumption for remediation increase

Engineering Contradiction:
Improvesystem recovery effectivenessVSAvoidremediation time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary actions by maintaining a stateful model that records the sequence of operations and their effects. When malware is detected, the system has already captured the necessary state information, enabling rapid restoration by reversing recorded operations without needing to perform extensive analysis or recovery procedures

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP4095724A1Method of remediating operations performed by a program and system thereof
Publication Date: 2022.11.30 SENTINEL LABS ISRAEL
  • EP4095724A1 patent drawingFigure 1a
  • EP4095724A1 patent drawingFigure 1b
  • EP4095724A1 patent drawingFigure 2

AI summary

There is provided a system and a computerized method of remediating one or more operations linked to a given program running in an operating system, the method comprising: querying a stateful model to retrieve a group of entities related to the given program; terminating at least a sub set of the group of entities related to the given program; generating a remediation plan including one or more operations linked to the given program, the one or more operations being retrieved based on the group in the stateful model; and executing the remediation plan by undoing at least part of the one or more operations linked to the given program thereby restoring state of the operating system to a state prior to the given program being executed. There is further provided a computerized method of detecting malicious code related to a program in an operating system in a live environment.