Zero-Day Malware Detection via Dynamic Behavioral Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus systems rely on signature-based detection methods that are ineffective for zero-day malware and fail to detect changes or variants within malware families, leading to delayed detection and false positives.
Innovation Solution
A method that monitors and extracts dynamic behavioral features of applications at runtime, creating a signature based on patterns of file operations, service usage, network data, and other activities to identify and detect zero-day malware and re-packaged applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection methods are used, then detection of known malware is achieved, but detection of zero-day malware is ineffective
Solution Approach 1:
The patent transitions from static signature-based detection to dynamic behavior-based detection. Instead of relying on fixed signatures that must be updated manually, the system dynamically monitors application behavior at runtime, automatically adapting to detect zero-day malware based on its actual execution patterns rather than pre-defined signatures.
Solution Approach 2:
The system performs preliminary behavior monitoring and analysis in a controlled environment before deployment. By pre-colving behavioral data from legitimate applications and establishing baseline patterns, the system prepares detection rules in advance that can immediately identify deviations indicative of malware, including zero-day variants.
2Measurement precision
If hash-based signatures are used, then individual malware files are detected, but malware families with similar behaviors cannot be detected
Solution Approach 1:
The patent creates behavioral signatures that serve multiple detection purposes simultaneously. A single behavioral signature can detect entire malware families by capturing common behavioral patterns shared across variants, while also being specific enough to identify individual malware instances, thus providing both family-level and file-level detection capabilities.
Solution Approach 2:
Instead of using fixed hash values that change with every compilation, the system uses behavioral parameters that remain consistent across malware family variants. By monitoring parameters such as file operations, registry modifications, and network communications during execution, the system identifies consistent behavioral patterns that define malware families regardless of code obfuscation or recompilation.
3Adaptability or versatility
If generic signatures are used, then malware families can be detected, but false-positive detections increase
Solution Approach 1:
The patent segments behavioral monitoring into multiple distinct categories such as file system operations, registry modifications, process creation, network communications, and hardware interactions. By dividing detection into these segments, the system can analyze specific behavioral patterns independently and combine results, reducing false positives while maintaining comprehensive malware family detection capability.
Solution Approach 2:
The system applies different detection thresholds and analysis methods to different behavioral segments based on their reliability and specificity. High-confidence indicators trigger immediate alerts, while lower-confidence behaviors are monitored in context with other segments, allowing the system to maintain high detection accuracy while avoiding false positives from overly generic signatures.
4Productivity
If static analysis is used, then detection speed is maintained, but runtime behavioral changes cannot be detected
Solution Approach 1:
The patent introduces a behavioral monitoring intermediary layer that operates between the application and the operating system. This intermediary passively observes and records runtime behaviors without interfering with application execution, enabling real-time detection of malicious activities while maintaining normal system performance and detection speed.
Data Source
AI summary
A method and system to identify and detect zero-day malware applications based on their behavioural analysis is disclosed. A new type of signature will be created out of dynamic behaviours of the applications, by monitoring and extracting some pre-defined features of the application such as file read/write, service start, loaded classes, incoming/outgoing network data which are gathered from the application at runtime. The method incorporates two steps for performing the identification: first, the dynamic behaviour is monitored and a pattern is extracted, then the activities of the actual application running on computer desktop or mobile device are intercepted and compared with the pattern previously extracted.