System Call Rate Tracing for Early Malware Process Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to effectively detect and mitigate malware, particularly ransomware, which can infect production systems and backups, causing data corruption and operational disruptions, with recovery processes being complicated and costly.
Innovation Solution
A forensic engine is employed to monitor system calls and learn malware behavior, allowing detection during the scanning phase by analyzing anomalous call rates, thereby preventing encryption or corruption of files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional backup systems are used to protect against data loss, then data availability is improved, but the system becomes vulnerable to malware infection of backups
Solution Approach 1:
The system performs preliminary detection of malware indicators (anomalous call rates, suspicious file access patterns) before malware can encrypt or corrupt backup data. By monitoring system calls and detecting anomalies during the scanning phase, the system prevents malware from completing its harmful actions on backup copies.
Solution Approach 2:
The patent introduces an intermediary detection layer between the backup system and malware. This intermediary monitors system calls, analyzes call rates, and detects suspicious patterns without directly interfering with normal backup operations. The intermediary identifies malware behavior patterns and triggers protection mechanisms before data corruption occurs.
2Measurement precision
If malware detection systems monitor all system calls, then detection accuracy is improved, but system performance degradation occurs
Solution Approach 1:
The system applies different monitoring intensities to different processes and files based on their risk profiles. High-value files and suspicious processes receive intensified monitoring with detailed system call analysis, while normal processes use lighter monitoring. This localized approach maintains detection accuracy for critical areas while reducing overall system overhead.
Solution Approach 2:
The patent implements partial monitoring by focusing detection resources on specific indicators of compromise rather than analyzing every system call in detail. The system monitors call rates and patterns continuously but performs deep analysis only when anomalies are detected, balancing detection accuracy with system performance.
3Loss of time
If real-time malware detection is implemented, then recovery time is reduced, but detection complexity increases
Solution Approach 1:
The system performs preliminary learning and baseline establishment during normal operation, capturing typical system call patterns and behaviors. When malware is detected, the system can quickly respond because it has pre-established what normal behavior looks like. This preliminary action reduces the complexity of real-time decision-making during actual malware incidents.
Solution Approach 2:
The patent implements feedback mechanisms where detection results and malware behavior patterns are continuously fed back into the system to refine detection algorithms. The system learns from detected malware patterns and adjusts its monitoring and detection strategies, reducing complexity over time as the system becomes more sophisticated at identifying threats with less intervention.
Data Source
AI summary
The system call rates associated with system calls made by applications or processes operating in a user space are determined and tracked. A malware detection engine, hidden from the user space and operating in the kernel space, is configured to identify anomalous system call rates. A malware process can be identified based on its anomalous system call rate. Once the malware process is identified, protection operations can be performed in the computing system.