Statistical Runtime Baseline for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection technologies are limited by their reliance on signature-based methods and dynamic analysis, which may not effectively identify infections, especially in systems with unknown pedigrees or performance profiles.
Innovation Solution
A system and method that uses instrumented functions to establish a statistical baseline runtime on malware-free devices and compares it with the actual runtime on potentially infected devices, detecting deviations to identify malware through temporal analysis and automatically initiating safe mode or quarantine.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If signature-based detection methods are used, then detection speed is improved, but detection accuracy deteriorates for unknown malware
Solution Approach 1:
The patent introduces statistical runtime data as an intermediary between the malware sample and the detection engine. Instead of directly comparing signatures, the system measures runtime statistics (execution time, memory usage, CPU consumption) and compares them against baseline statistics from known-good executions. This intermediary statistical layer enables detection of unknown malware while maintaining high detection speed through efficient statistical comparison.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a statistical analysis system. Instead of mechanically searching for known byte patterns, the system uses statistical measurements of program behavior (runtime characteristics, resource consumption patterns) to detect malware. This substitution allows detection of previously unseen malware variants by comparing their statistical profiles against established baselines.
2Measurement precision
If dynamic analysis such as sandboxing is performed, then detection accuracy is improved, but analysis completeness deteriorates due to trigger condition dependencies
Solution Approach 1:
The patent performs preliminary statistical baseline measurements on known-good executions of programs before they are potentially infected. These baseline statistics (runtime, memory usage, CPU consumption patterns) are captured and stored in advance. When malware detection is needed, the system compares current execution statistics against these pre-established baselines, enabling detection without requiring complete dynamic analysis or triggering specific conditions during analysis.
3Measurement precision
If statistical baseline runtime analysis is performed, then detection accuracy is improved, but device complexity increases
Solution Approach 1:
The patent changes the parameter space from analyzing individual instruction-level behaviors to analyzing aggregate statistical parameters (total runtime, average memory usage, CPU consumption patterns). By transforming the detection problem into a statistical parameter comparison task, the system achieves high detection accuracy while keeping implementation complexity manageable through focusing on a limited set of measurable statistical parameters.
Data Source
AI summary
A system detects malware in a computing architecture with an unknown pedigree. The system includes a first computing device having a known pedigree and operating free of malware. The first computing device executes a series of instrumented functions that, when executed, provide a statistical baseline that is representative of the time it takes the software application to run on a computing device having a known pedigree. A second computing device executes a second series of instrumented functions that, when executed, provides an actual time that is representative of the time the known software application runs on the second computing device. The system detects malware when there is a difference in execution times between the first and the second computing devices.