Suspicious Action Delay Queue for Wiper Malware Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional ransomware protection methods, such as antivirus software and backups, are ineffective against wipers, which delete files and require immediate access to the target system, making them difficult to defend against.
Innovation Solution
A system that delays potentially harmful actions by categorizing them as benign, malicious, or suspicious, using processor circuitry to monitor system operations, apply predefined policies, and machine learning models to determine the nature of these actions, and perform tempered actions during the delay.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus software and backups are used, then protection against ransomware is provided, but protection against wipers is ineffective
Solution Approach 1:
The system dynamically adjusts its response based on the classification of system operations. Instead of static blocking or allowing, the system transitions between different states (monitoring, delaying, blocking) based on the suspiciousness level and classification results of detected operations, enabling adaptive protection against both ransomware and wipers
Solution Approach 2:
The system changes the temporal parameter of operation execution by introducing variable delays for suspicious actions. The delay duration and classification process transform the system's response characteristics, allowing time for analysis while maintaining system functionality for benign operations
2Object-affected harmful factors
If suspicious actions are immediately blocked, then malicious actions are prevented, but legitimate actions may be hindered
Solution Approach 1:
The system introduces a classification mechanism as an intermediary between detection and blocking. Suspicious operations are routed through a classification process that analyzes multiple attributes and contextual information before determining whether to block or allow the operation, preventing false positives while maintaining security
Solution Approach 2:
The system performs preliminary classification and analysis on suspicious operations before final blocking decisions are made. This preliminary action includes gathering contextual information, analyzing operation patterns, and determining maliciousness likelihood, allowing legitimate operations to proceed while preparing to block confirmed threats
3Measurement precision
If system operations are monitored and classified in real-time, then malicious actions are detected, but system performance may be degraded
Solution Approach 1:
The system applies different levels of monitoring and classification intensity to different operations based on their suspiciousness level. High-confidence benign operations receive minimal processing, while suspicious operations undergo more intensive analysis, optimizing the balance between detection accuracy and system performance
Data Source
AI summary
A device and method are provided for protecting against malware attacks affecting a computer system. To do so, system operations are detected and categorized as benign, suspicious, or malicious. Suspicious actions are delayed and placed in a queue instead of being immediately executed. The process initiating the suspicious action is determined and the suspicious action is categorized as benign or malicious based on the initiating process. When the suspicious action is categorized as a benign action, the suspicious action is performed. Conversely, when the suspicious action is categorized as a malicious action, the suspicious process is terminated, and the malicious action is removed from the unperformed actions queue without performing the malicious action.