Whitelist Malware Detection via Server-Side Behavior Analysis

Solution Overview

Problem

Traditional malware detection methods rely on feature libraries that lag behind the exponential growth of malware, making it difficult to keep up with emerging threats, especially with anti-antivirus techniques that obscure malicious features and behaviors.

Innovation Solution

A method that uses a white list based on legitimate programs, where client-side program features and behaviors are sent to a server for comparison against a dynamically updated database, determining legitimacy and assigning trust values to classify programs as legitimate or malware.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional feature library approaches are used for malware detection, then detection can be performed locally, but the detection capability lags behind the exponential growth of malware and cannot keep up with emerging threats

Engineering Contradiction:

Improvemalware detection capabilityVSAvoidtime lag in detecting new malware

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent inverts the traditional blacklisting approach by implementing a whitelisting mechanism. Instead of maintaining a database of known malware signatures that becomes outdated, the system maintains a database of known legitimate programs and their behaviors. New programs are presumed legitimate until proven otherwise, reversing the burden of proof and enabling faster response to emerging threats.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The system incorporates feedback mechanisms where client-side antivirus software reports on program behaviors and outcomes to the server-side database. This feedback loop allows continuous learning and updating of the whitelisting database, enabling the system to adapt to new malware techniques and improve detection accuracy over time.

Inventive Principle:

Principle #23Feedback

2Productivity

If feature codes are collected and updated in the feature library, then malware detection can be performed, but the generation and update of the feature library lags behind the explosive growth rate of malwares

Engineering Contradiction:

Improvemalware detection efficiencyVSAvoidvolume of malware variants

Core Design Contradiction:

ProductivityVSQuantity of substance

Solution Approach 1:

The patent inverts the traditional blacklisting approach by implementing a whitelisting mechanism. Instead of maintaining a database of known malware signatures that becomes outdated, the system maintains a database of known legitimate programs and their behaviors. New programs are presumed legitimate until proven otherwise, reversing the burden of proof and enabling faster response to emerging threats.

Inventive Principle:

Principle #13The other way round (Inversion)

3Adaptability or versatility

If anti-antivirus techniques are applied by malware producers through packing and modifying feature codes, then malware can evade detection, but this makes it more difficult to determine malware by malicious behavior and feature

Engineering Contradiction:

Improvemalware evasion capabilityVSAvoiddifficulty in determining malware

Core Design Contradiction:

Adaptability or versatilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent inverts the traditional blacklisting approach by implementing a whitelisting mechanism. Instead of maintaining a database of known malware signatures that becomes outdated, the system maintains a database of known legitimate programs and their behaviors. New programs are presumed legitimate until proven otherwise, reversing the burden of proof and enabling faster response to emerging threats.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The system performs preliminary analysis of program behaviors and characteristics before they can execute malicious actions. By collecting and analyzing program behaviors in advance and comparing them against the whitelisting database, the system can prevent malware from evading detection through packing and modification techniques.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS9715588B2Method of detecting a malware based on a white list

Publication Date: 2017.07.25 BEIJING QIHOOD TECHNOLOGY CO LTD

AI summary

A method of detecting a malware based on a white list comprises: receiving on a server side a program feature and/or a program behavior of a program to be detected sent from a client side; comparing the program feature and/or the program behavior of the detected program with legitimate program features and/or legitimate program behaviors stored in a white list; obtaining a legitimacy information of the unknown program based on the comparison result and feeding this back to the client side. In the invention, a legitimate program is determined by using a white list, thereby determining an illegitimate program excluded from the white list as a malware, which performs a determination and detecting and removing of a malware from another perspective.