Virtual Logon Session for Malware Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security solutions fail to effectively block unknown malware, rely on inaccurate heuristic algorithms, and require large databases that need frequent updates, leading to performance issues and time-consuming analysis processes.
Innovation Solution
A system and method that creates a user virtual logon session desktop to run applications in a partitioned environment, using a security authority plug-in with OS privileges to intercept and monitor kernel resources, and manage user credentials, thereby isolating applications and preventing malware attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security solutions use heuristic algorithms to detect malware, then unknown malware can be detected, but false alarms occur and user experience deteriorates
Solution Approach 1:
The system segments the execution environment by creating a virtual logon session that isolates the application from the user's main desktop environment. This segmentation allows the application to run in a controlled, isolated space where malicious behaviors can be contained without affecting the user's system, thereby reducing false alarms while maintaining detection accuracy.
Solution Approach 2:
The virtual logon session acts as an intermediary layer between the application and the user's operating system. This intermediary provides a buffer that allows monitoring and control of application behaviors without directly impacting the user environment, enabling accurate malware detection while preventing false alarms from disrupting user operations.
2Reliability
If malware definitions database is updated frequently to detect new malware, then detection capability improves, but system performance deteriorates due to large database size
Solution Approach 1:
The system performs preliminary actions by creating a virtual logon session and establishing monitoring mechanisms before the application executes. This preliminary setup allows the system to detect and respond to malicious behaviors in real-time without needing to maintain a large, frequently updated malware definitions database, thus preserving system performance while maintaining detection capability.
Solution Approach 2:
The system replaces the traditional mechanical approach of maintaining large malware definitions databases with a behavioral monitoring approach. Instead of relying on pattern matching against stored signatures, the system monitors application behaviors and interactions within the virtual logon session, substituting the database-dependent mechanism with a more efficient behavior-based detection system.
3Reliability
If real-time monitoring of application behaviors is implemented to detect malware, then malware detection accuracy improves, but user experience deteriorates due to annoyance and distraction
Solution Approach 1:
The system segments monitoring activities into a separate virtual logon session that is isolated from the user's main desktop environment. This segmentation allows comprehensive real-time monitoring to occur in the background without presenting alerts or interruptions to the user, maintaining detection accuracy while preserving user experience.
Solution Approach 2:
The virtual logon session serves as an intermediary that absorbs and contains monitoring activities. This intermediary layer allows the system to perform detailed behavioral analysis without directly interacting with or disturbing the user's workflow, thereby maintaining both detection accuracy and ease of operation.
Data Source
AI summary
The malware protection system provides a virtual logon session which runs in the background invisible to the user. The virtual logon session is created on a computer system with the help of the operating system using a separate/partitioned kernel resources such as a desktop, that provides a limited access environment under the context of a logged-on user. The system is configured to run applications inside virtual logon sessions under the logged-on user's credentials with limited access. The system also includes an interceptor module that launches the web browser or web application inside the virtual logon session. The interceptor module intercepts every URL passing through the web browser or web application being run in the virtual logon session. The module checks if the primary web URL is infected by malware and adds the malicious URL to a malicious URL database and a non-malicious URL to a non-malicious URL database.