Entity profile signatures for improving malware detection

Abstract

A malware detection engine monitors the behavior of a software entity. Meanwhile, outside of the malware detection engine, an engine steering module dumps a profile of the software entity, for instance as a text file listing current values of state and behavioral attributes characterizing the respective software entity. The entity profile is then checked against a set of pre-defined signatures. In response to a signature match, the engine steering module re-configures a manner in which the malware detection engine monitors the software entity, for instance causing the malware detection engine to switch from using a set of simple heuristics to using a more sophisticated malware detection model. Such signature matching performed outside of a currently executing detection engine enables fast development and testing of new detection models and heuristics, for subsequent implementation into the engine itself.