Threat Score Determination via Document Sandbox Simulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IT security methods for detecting malicious behavior in electronic documents are limited, as they either consume local resources, fail to prevent remote effects, or can be spoofed by evolving obfuscation techniques, and lack comprehensive behavioral analysis.
Innovation Solution
A method involving loading and rendering electronic documents in a document sandbox, simulating user interactions, monitoring for predefined event classes, and determining a threat score using numerical weights, which allows for remote security classification and access filtering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If specialized programs monitor behavior locally on the user device, then malicious behavior can be detected, but memory and computing resources are consumed on the user device
Solution Approach 1:
The patent introduces a remote server as an intermediary that performs the actual monitoring and analysis of electronic documents. The user device only needs to transmit documents to the server, which then executes specialized programs remotely to detect malicious behavior. This mediator approach transfers resource consumption from the user device to the remote server, resolving the contradiction between detection capability and local resource usage.
2Reliability
If specialized programs detect malicious behavior only when it happens on the user device, then protection from effects is provided, but access to the electronic document cannot be prevented thus wasting bandwidth
Solution Approach 1:
The patent implements preliminary analysis of electronic documents on a remote server before they are fully transmitted to or executed on the user device. The server performs static and dynamic analysis to identify malicious documents in advance, allowing access to be blocked before the document reaches the user device. This preliminary action prevents bandwidth waste by stopping transmission of malicious documents before they can cause harm or consume user device resources.
3Reliability
If access filters analyze content by searching for predefined patterns, then remote security measures are provided, but strategies for avoiding detection have evolved through obfuscation and encryption
Solution Approach 1:
The patent transitions from static pattern matching to dynamic behavior analysis. Instead of relying on fixed predefined patterns that can be evaded through obfuscation, the system executes the electronic document in a controlled sandbox environment and monitors its actual runtime behavior. This dynamic approach captures what the document actually does rather than what it appears to do, making obfuscation and encryption ineffective since the analysis is based on observable actions rather than static code patterns.
4Reliability
If sandboxes enforce behavioral restrictions without monitoring compliant behaviors, then security is achieved by limiting effects, but information on suspicious behaviors cannot be combined to provide evaluation or categorization
Solution Approach 1:
The patent implements comprehensive monitoring and feedback mechanisms within the sandbox environment. While the sandbox enforces behavioral restrictions to contain effects, the system simultaneously monitors and records all compliant behaviors that occur within those restrictions. This feedback loop collects information about suspicious patterns, combines multiple observations, and uses them to evaluate and categorize documents. The monitoring system provides continuous feedback about document behavior, enabling sophisticated analysis without compromising security containment.
Data Source
AI summary
A method and a computer system are disclosed for determining a threat score of an electronic document comprising the steps of: loading and rendering the electronic document in a document sandbox, controlling the document sandbox to simulate user interaction with the electronic document, while loading and rendering the electronic document and while controlling the document sandbox to simulate user interaction with the electronic document, monitoring the document sandbox for events triggered by the electronic document and belonging to one of at least two predefined event classes, recording each observed event together with a respective event class to which each observed event belongs, and determining a threat score of the electronic document based on predefined numerical weights associated with each of the predefined event classes to which the recorded events belong.