Worm Detection Module for Drive Sharing Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to effectively detect and prevent the spread of drive-sharing worms across computer networks, particularly in enterprise environments, due to limitations in anti-virus software detection and the challenges posed by polymorphic or metamorphic worms.
Innovation Solution
A worm detection module (WDM) monitors storage devices for activity directed towards executable files by remote processes, flags potentially malicious files, and performs secondary tests to determine worm-like characteristics, ultimately blocking the files from creating executable instances on other computer systems to prevent propagation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anti-virus software is installed to detect worms and viruses, then detection capability is improved, but false positives increase and previously unknown worms may still evade detection
Solution Approach 1:
The system performs preliminary flagging of files created by remote processes before they can execute or spread. By monitoring file creation events and flagging suspicious files in advance, the system prepares for potential worm activity without immediately blocking legitimate files, thus reducing false positives while maintaining detection capability
Solution Approach 2:
The patent introduces an intermediary mechanism (the flagging system) between file creation and execution. Rather than directly blocking files based on anti-virus detection, the system uses flags as an intermediate marker that triggers further evaluation only when the file attempts to create executable instances, reducing premature false positives
2Productivity
If drive sharing is enabled to increase productivity, then data accessibility is improved, but rapid worm propagation occurs across the network
Solution Approach 1:
The flagging system acts as an intermediary between drive sharing functionality and worm propagation. Files flagged by the monitoring module are subjected to secondary tests before allowing network propagation, thus maintaining drive sharing productivity while blocking worm spread through the intermediate evaluation step
Solution Approach 2:
The system applies preliminary anti-action by flagging files created by remote processes before they can propagate worms across the network. This pre-emptive measure counters the harmful effect of drive sharing being exploited for worm propagation while preserving legitimate file sharing operations
3Measurement precision
If monitoring of all file activity is performed to detect worms, then detection completeness is improved, but system performance deteriorates
Solution Approach 1:
The system applies partial monitoring by focusing only on file creation events rather than monitoring all file operations. By selectively monitoring only the specific action (file creation) that indicates potential worm propagation, the system maintains detection completeness for worm activities while minimizing performance impact from unnecessary monitoring of other file operations
Data Source
AI summary
A worm detection module (WDM) (212) stops worms and other malicious software from spreading among computer systems (100) on a network (210) via open drive shares. The WDM (212) monitors (310) a storage device (108) for activity (314, 316) directed to executable files by remote processes. The WDM (212) flags (318) files (216) that are the target of such activity. If a flagged file (216) attempts to create an executable file (218) on a networked computer system (100B), the WDM (212) detects (322) that the flagged file (216) is a worm. In response, the WDM (212) blocks the write to the networked computer system (100B) and thereby prevents the worm from propagating.