Thread Pattern Malware Detection via Context Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for detecting malware struggle to identify new or unknown viruses and malware, as they rely on known patterns and require processing vast amounts of data, making it impractical for humans to detect malware in real-time, especially in environments with numerous executing threads.
Innovation Solution
The system captures context information for each thread, including execution time, file access, and API usage, to define thread patterns, compares these patterns to stored known patterns, and detects variations, which may indicate malware presence, using machine learning to update known patterns and perform actions such as quarantining or blocking suspicious threads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virus patterns are used for malware detection, then known malware can be identified, but new or unknown malware cannot be detected
Solution Approach 1:
The system dynamically adapts its detection approach by switching from static virus pattern matching to dynamic thread pattern analysis. It captures contextual information about thread execution behavior, file access patterns, and system API usage to create living profiles of legitimate threads, enabling detection of previously unknown malware variants that evade static pattern recognition.
Solution Approach 2:
The invention changes the detection parameters from fixed virus signatures to variable thread behavior parameters. By monitoring execution time, time between successive executions, file access patterns, network traffic, and system API usage, the system detects malware based on anomalous behavioral parameters rather than relying on known malware patterns.
2Measurement precision
If thread pattern detection is performed manually, then detailed analysis is possible, but processing enormous amounts of data from multiple systems becomes impractical
Solution Approach 1:
The system performs self-service by automatically capturing, storing, and analyzing thread contextual information without human intervention. The malware detection system autonomously monitors thread execution, captures contextual data, compares patterns, and identifies anomalies, eliminating the need for manual analysis of enormous datasets from multiple systems.
Solution Approach 2:
The invention replaces manual mechanical analysis with automated computational systems. Instead of human analysts manually processing thread data, the system uses automated pattern recognition algorithms that process vast amounts of thread contextual information rapidly, substituting human cognitive processing with machine-based pattern matching and anomaly detection.
3Speed
If real-time thread monitoring is implemented, then malware detection speed improves, but system complexity increases
Solution Approach 1:
The system segments the monitoring function by capturing contextual information for individual threads separately and storing it in association with each thread's identifier. This segmentation allows the system to monitor multiple threads simultaneously without overwhelming complexity, as each thread's contextual data is managed independently and can be processed in parallel.
Solution Approach 2:
The invention introduces contextual information as an intermediary layer between thread execution and malware detection. By capturing and storing thread context (execution time, file access, API usage) as intermediate data, the system simplifies the monitoring process and enables real-time analysis without direct complex interactions between all system components.
4Reliability
If known virus patterns are used for detection, then detection accuracy for known malware is maintained, but the ability to detect unknown threats is lost
Solution Approach 1:
The system performs preliminary action by capturing and storing thread contextual information before malware infection occurs. By establishing baseline thread patterns in advance and continuously monitoring for deviations, the system can detect unknown malware variants as they deviate from legitimate thread behavior patterns, rather than relying on post-infection signature matching.
Data Source
AI summary
Embodiments provide for detecting viruses and other malware in executing process threads based on thread patterns. According to one embodiment, detecting previously unknown malware associated with process threads can comprise capturing context information for each thread of a plurality of threads executing on a processor. The context information can define a thread pattern for the thread. The thread pattern for each thread can be compared to stored information defining one or more known patterns for thread execution based on previous execution of one or more threads. A thread pattern variation can be detected when the thread pattern for one or more threads does not match the stored information defining the known thread patterns. A determination can be made as to whether the detected thread pattern variation indicates presence of malware and actions can be performed based on determining the detected thread pattern variation indicates the presence of malware.