RU107615U1 - SYSTEM FOR REDUCING THE NUMBER OF FALSE FACES OF AN ANTI-VIRUS SYSTEM - Google Patents

Abstract

 1. A system for analyzing false positives of an anti-virus system, including an anti-virus server connected to at least one user's personal computer, while the user's personal computer includes:! a) an antiviral agent associated with the following agents:! - a base of rules on the side of the user's personal computer; ! - a base of correction factors on the side of the user's personal computer; ! - update tool on the side of the user's personal computer; ! - a means of generating reports on an anti-virus server; ! at the same time, the mentioned antivirus tool is designed to check the processes that are called up when objects are launched using the rule base and the base of correction factors; ! b) update tool on the side of the user's personal computer associated with the following tools:! - a base of rules on the side of the user's personal computer; ! - a base of correction factors on the side of the user's personal computer; ! - update tool on the anti-virus server side; ! wherein said update tool on the side of the user's personal computer is configured to be launched by an anti-virus tool and is intended to update the rule base and the database of correction factors received from the update tool on the anti-virus server side; ! c) the rule base on the side of the user's personal computer, which contains a set of rules for detecting malicious objects; ! d) the base of correction factors on the side of the personal computer

Description

Technical field

The utility model relates to systems for reducing the number of false positives of anti-virus systems that use process ratings to determine malicious objects.

State of the art

In connection with the rapid development of computer technology and computer networks, the problem of protecting against malicious objects that enter users' computers is becoming increasingly large.

Currently, many systems are used to solve this problem. Anti-virus systems use different approaches when doing their job: signature verification, heuristic analysis, behavioral analysis.

Signature analysis is a classic method for searching for viruses and other malicious objects. The essence of this approach is the use of samples of program code obtained in the analysis of known malicious code. Samples are called signatures. Virus scanning takes place during the scanning process of potentially dangerous program code. If during scanning a code is found that matches the signature code template, then an object containing such code is classified as malicious. Signature analysis ensures the detection of malicious objects that are described by signatures, but are not able to detect unknown viruses.

Heuristic analysis allows you to determine the presence of data that can be harmful before starting the object itself. Behavioral analysis consists in tracking all the processes launched by various objects. In case of suspicious process behavior, which is determined by the rules, the anti-virus system takes protective measures. This method has a drawback: during behavioral analysis, the antivirus system may skip some known viruses.

Modern anti-virus systems successfully use several approaches at once to increase the effectiveness of the fight against malicious objects, taking advantage of each method and compensating for their shortcomings.

A system that uses technology based on the study of executable executable files and the assessment of behavior based on a system of rules is described in patent US 7530106 and is designed to detect viruses and other types of malicious objects using security ratings of computer processes calculated according to the rule system. The rules themselves are formed on the basis of the analysis of the studied malicious objects and the behavior of processes associated with malicious objects. Each rule has a specific structure: rule identifier, called API function (Application Programming Interface, API - a set of ready-made classes, functions, structures and constants provided by the operating system for use in external software applications), conditions for arguments, hazard assessment. That is, the rule will work if the process calls an API function with the appropriate parameters, and in this case the process rating will be increased in accordance with the rule’s assessment.

Rules are stored in updated databases. As new computer viruses continuously appear, the system of rules should be periodically updated, reviewed, supplemented.

In any anti-virus system, there is a chance of errors during operation. Errors are divided into so-called errors of the first kind and errors of the second kind. Errors of the first kind appear when the anti-virus system detects a malicious object, although in fact the object does not pose any threat. In other words, a false positive occurs. Errors of the second kind with respect to anti-virus systems are associated with the situation when the system does not detect it in the presence of a virus or other malicious object.

Previous systems could make both errors of the first kind, that is, cause false positives, and errors of the second kind, that is, skip and not detect objects that are dangerous for a personal computer. To improve the quality of the antivirus system, there is a need to reduce the likelihood of errors of the first and second kind.

The proposed system has an advantage over the patented system. It allows you to reduce the number of false positives of the anti-virus system when detecting malicious objects.

An analysis of the prior art and the possibilities that arise when combining them in one system allows you to get a new result, namely a system to reduce the number of false positives of anti-virus systems that use process ratings to determine malicious objects.

Utility Model Essence

The technical result of the utility model is to reduce the number of false positives of the anti-virus system, which is achieved by adjusting the rules for detecting malicious objects using corrective coefficients.

This useful model is a system for analyzing false positives of an anti-virus system, including an anti-virus server connected to at least one personal computer of the user, while the personal computer of the user includes:

a) an antiviral agent associated with the following agents:

- the basis of the rules on the side of the user's personal computer;

- a base of correction factors on the side of the user's personal computer;

- update tool on the side of the user's personal computer;

- a means of generating reports on an anti-virus server;

at the same time, the mentioned antivirus tool is designed to check the processes that are called up when objects are launched using the rule base and the base of correction factors;

b) update tool on the side of the user's personal computer associated with the following tools:

- the basis of the rules on the side of the user's personal computer;

- a base of correction factors on the side of the user's personal computer;

- update tool on the anti-virus server side; wherein said update tool on the side of the user's personal computer is configured to be launched by an anti-virus tool and is intended to update the rule base and the database of correction factors received from the update tool on the anti-virus server side;

c) the rule base on the side of the user's personal computer, which contains a set of rules for detecting malicious objects;

d) the base of correction factors on the side of the user's personal computer, which contains a set of correction factors for the rules from the rule base;

the anti-virus server includes:

I) a reporting tool associated with a data storage means, wherein said reporting tool is configured to receive data from an anti-virus tool on a user's computer and based on the received reporting data;

II) data storage means associated with a false positive analysis means, wherein said data storage means is intended for storing reports received from the reporting means;

III) means of analysis of false positives associated with the following means:

- a means of storing a black list;

- a base of correction factors on the anti-virus server side;

- a rule base on the anti-virus server side;

the said false positive analysis tool is intended to analyze the data contained in the data storage tool, using the checksums in the blacklist storage tool for analysis, is also intended to form a database of correction factors and a rule base based on the analysis, which allows to reduce the number of false positives of the anti-virus system;

Iv) said blacklist storage facility containing checksums of known malicious objects;

V) an anti-virus server-side update tool associated with the following tools:

- a rule base on the anti-virus server side;

- a base of correction factors on the anti-virus server side;

however, the said update tool on the anti-virus server side is configured to send a new version of the rule base on the anti-virus server side and the correction coefficient database on the anti-virus server side when the update tool is requested on the user's personal computer.

VI) the mentioned rule base on the anti-virus server side, containing a set of rules updated as a result of the operation of the false positive analysis tool;

VII) said base of correction coefficients on the anti-virus server side, containing a set of correction coefficients for the rules from the said rule base, updated as a result of the operation of the false positive analysis tool;

In a particular embodiment, the anti-virus tool of the said system is capable of transmitting to the reporting tool data containing at least the checksum of the found object on which the rule worked, the rule number that worked, the process rating set by the rule, and the overall process rating.

In a private embodiment, the processes being checked are processes that are called when objects are launched in the operating system of the user's personal computer.

In a private embodiment, the malicious object is that object that caused the process to receive a rating that is higher than a hazard rating as a result of an anti-virus scan.

In a particular embodiment, the base of correction factors and the rule base of the said system are made with the possibility of independent updating.

In a private embodiment, the anti-virus tool of the said system is configured to terminate the process caused by the malicious object upon detection of the malicious object.

In a particular embodiment, said means of analyzing false positives is configured to perform an on-line analysis to form a base of correction factors on the anti-virus server side.

In a private embodiment, said false positive analysis tool is configured to perform a general analysis to form a rule base on the anti-virus server side.

Brief Description of the Drawings

The accompanying drawings are intended to better understand the claimed utility model, form part of this description, illustrate embodiments of the utility model, and together with the description serve to explain the principles of the utility model.

Figure 1 displays the structure of the computer of the user entering the system to reduce the number of false positives.

Figure 2 illustrates the structure of the anti-virus server included in the system to reduce the number of false positives.

Figure 3 shows the structure of the storage medium.

Figure 4 shows the process of rating formation during anti-virus scanning.

Figure 5 illustrates the algorithm for anti-virus scanning on a user's personal computer.

6 shows the algorithm of the anti-virus server.

7 shows an example of a general-purpose computer system on which this utility model can be implemented.

Description of Embodiments

Figure 1 shows the structure of the computer of the user entering the system to reduce the number of false positives. In one embodiment, the system for reducing the number of false positives of an anti-virus system consists of at least a user's personal computer and an anti-virus server.

An anti-virus tool 110 is installed on the personal computer of user 100, which searches for malicious objects. As an object, for example, an executable file can be considered, when launched, the process starts in the operating system. To detect malicious objects, the antivirus tool scans 140 processes caused by objects. When checking processes, a set of rules 132 is used from rule base 130 on the side of the user's personal computer. Rules are a set of descriptions of processes that can pose a threat to a computer. All rules are stored on the user's computer in the form of a rule base on the side of the personal computer of the user 130. Each rule has its own number 131, which is assigned to it for the entire time the rule is used. The rule number is unique and serves to uniquely identify a specific rule.

In addition to the rule base, a database of correction factors 120 is stored on the user's personal computer. Correction factors are also used by an antivirus tool in the process of determining malicious objects. In more detail, the process of determining malicious objects will be discussed in the description of Figure 4. Each rule 132 from the rule base on the personal computer side of user 130 corresponds to one coefficient 122 from the coefficient base on the personal computer side of user 120, which has number 121 corresponding to rule 131 number.

The rule base and the coefficient base on the user's computer side can be updated. The update is carried out using the update tool on the side of the personal computer 150. Antivirus tool 110 before starting the search for malicious objects launches the update tool, which communicates with the update tool on the side of the anti-virus server 270, transmits information about the database version. The updater on the anti-virus server side 270 receives information about the version of the databases and compares it with the version of the available databases on the anti-virus server. If the update tool on the anti-virus server side 270 determines that a newer version of the databases is available than the one located on the user's personal computer, the update tool on the anti-virus server side transfers the new version of the databases to the update tool on the side of the user's personal computer 150. The update tool on to the side of the personal computer 150, the user receives an updated version of the databases and replaces the old databases. In this case, the coefficient base on the side of the personal computer 120 and the rule base on the side of the personal computer 130 are updated independently of each other.

The coefficient base 120 has a size much smaller than the rule base 130, which allows frequent updates of the coefficient base, and the use of network resources will not increase as much as in the case of frequent updating of the rule base. Therefore, the use of a separate update mechanism for the coefficient base and the rule base allows reducing the use of network resources with frequent updating of the coefficient base 120.

Anti-virus tool 110 communicates with anti-virus server 160 if it has detected a dangerous process and the corresponding object that caused this process. When a malicious object is detected, antivirus tool 110 terminates the dangerous process.

Using one of the well-known cryptographic algorithms, such as MD5, MD4, SHA1, SHA256 or CRC32, the anti-virus tool 110 creates a checksum of the malicious object that caused the detected process, which allows you to uniquely identify the malicious object. Next, the anti-virus tool 110 transmits the checksum along with information about the triggered rule and the rated rating to the anti-virus server 160.

The anti-virus server is depicted in Figure 2. Information about all detected malicious objects is sent to the anti-virus server 160 from the personal computer of the user 100. All information is sent to the reporting tool 210, which processes the incoming information and puts it into the data storage tool 220. The data storage tool 220 is a database. In more detail, the data storage means is shown in FIG. 3. The data in the data storage means is structured in a table. Each line contains information about the detected object. The data storage tool contains information received from an anti-virus tool, which consists of at least the checksum of the malicious object 221, the process rating 222, the numbers of the triggered rules 223 and the ratings 224 set by each rule.

The false positive analysis tool 230 processes the accumulated data received from the anti-virus tool and stored in the data storage tool. During processing, a search is carried out for safe objects by checksums 221. At the same time, a blacklist storage facility 240 is used, in which checksums of malicious objects are stored. The false positive analysis tool 230 searches for those checksums that are in the data storage tool 220 but not in the blacklist storage tool. An object whose checksum is not available in the blacklist storage facility is safe, therefore, if its checksum is found among the checksums of detected malicious objects in the data storage facility, this will indicate a false operation of the anti-virus system.

After all safe objects are found, the false positive analysis tool 230 analyzes the rules that affected the appearance of false positives during anti-virus scanning. The analysis establishes the numbers of rules 223, which worked at a safe site, takes into account the overall rating of the process 222 associated with the site, which shows how much the threshold value is exceeded, and also takes into account the rating 224 set by each rule in the formation of the overall rating.

The operation of the false positive analysis tool 230 can be divided into two stages: the operational analysis of false positives and the general analysis of false positives. Operational analysis is performed with a small frequency, and the data collected over a short time interval, for example, several hours, is examined.

As a result of the operational analysis, a database of correction factors is formed on the side of the anti-virus server 250 for the rules that contributed to the occurrence of false positives. The base includes only coefficients other than unity, which allows to reduce the size of the base. Thus, the database can be represented in the form of rule numbers 251 and correction factors for them 252. After the formation of the correction factors database on the side of the anti-virus server 250, the database is available for personal computers of users for updating. In its final form, the database has a small size of about 500 bytes, which facilitates the process of frequent updating the database. With the help of correcting coefficients, the contribution to the process rating formation is changed, which in the future will not lead to the appearance of false positives at safe sites.

General analysis of false positives is less common than operational analysis. When conducting a general analysis, the false positive analysis tool 230 processes the data collected over a long period of time, for example, a week. As a result of a general analysis, the false positive analysis tool forms the rule base on the side of the anti-virus server 260. The rule base contains the rule numbers 261 and the modified rules 262, which previously contributed to the occurrence of false positives. The base coefficient is changed, which directly affects the rating set by the rule when malicious objects are detected. Changes may also affect the structure of the rule itself, in which case it is necessary to involve an expert, this procedure is carried out in a semi-automatic mode.

After the rule base on the side of the anti-virus server 260 is formed, the analysis tool 230 resets the correction factors, assigning a single coefficient to the changed rules. Thus, the correction coefficient for the changed rules is equal to one, it can be adjusted according to the results of the changed rules using the database of correction factors. After the formation of the rule base on the anti-virus server side, it is available for personal computers of users for updating.

The databases are updated using the update tool on the side of the anti-virus server 270, which receives a request from the user's personal computer and, if the databases on the user's personal computer are out of date, sends a new version of the databases to the personal computer.

In a particular embodiment, the correction coefficients may not be reset using analysis tool 230. Updating the base of correction coefficients is often carried out, which will automatically correct the coefficients according to the results of the changed rules as soon as possible.

If for some reason the base of correction factors and the rule base cannot be updated by the user's computer, then the antivirus tool uses the latest downloaded version of the databases.

Figure 4 shows the process of rating formation during anti-virus scanning. Anti-virus scan is performed by anti-virus tool 110 on a user's computer. The anti-virus tool checks running processes in order to establish their level of danger and conclude that the objects that launched the processes are malicious. In the verification process, the rule base 130 and the coefficient base 120 are used. When analyzing the process, several rules 401-403 can work. Each rule has a base coefficient p _i (i = 1 ... n, where n is the number of the last rule), which can change only when the rule itself changes after updating the rule base. The base coefficient laid down in the rule affects the rating set by the rule. However, the rule base 130 is updated less frequently than the base of the correction factors 120. When forming the final rating, the correction factors 404-406 are also taken into account, which help to quickly change the rating of a particular rule.

For one process several rules can work at once. Each rule contributes to the final conclusion about whether the process is dangerous. The contribution from each rule consists of two components: the base coefficient p and the correction coefficient k. The contributions from each rule are summed up and form the overall rating of the process 407. If the overall rating exceeds the threshold hazard rating, the process is recognized as dangerous, and the corresponding object is harmful. If the threshold rating is not reached, then the object is considered safe.

Using the correcting coefficients 404-406, the rating set by the rule is changed, therefore, if the rule often defines safe objects as malicious, then its coefficient can be reduced, and, therefore, the contribution from such a rule will decrease. Such a rule will make a smaller contribution to the final rating of the process 407 and the number of false positives involving this rule will be reduced. Using correction factors for the entire set of rules will reduce the total number of false positives of the anti-virus system.

The number of false positives also decreases when updating the rule base, when the base coefficient or rule structure changes. In this case, the rating p set by the rule will be adjusted so that the rule does not cause false positives on harmless objects.

Figure 5 shows the algorithm for conducting antivirus scans on a user's personal computer.

At step 501, the coefficient database is updated on the side of the personal computer of user 120 and the rule base on the side of the personal computer of user 130. The update is performed using the update tool on the side of the personal computer of user 150 and the update tool on the side of the anti-virus server 270. After updating the databases, the process starts step 502, and antivirus tool 110 generates an overall security rating based on the rule base and coefficient base at step 503. A security rating is required To infer whether the object that caused the process under study, malicious. After the rating is generated, at step 504, a check is made that the security threshold is exceeded by the existing rating. If the threshold is exceeded, the antivirus tool stops the dangerous process at step 505. Next, at step 506, the antivirus tool sends information about the object that caused the dangerous process, the rules that worked and the ratings they set, as well as the overall rating for this process to the anti-virus server 160.

If the obtained overall rating of the process did not exceed the threshold value, then the antivirus tool allows you to continue the process 507, while the overall rating is updated and compared with the threshold value.

Figure 6 shows the algorithm of the anti-virus server.

At step 601, the anti-virus server receives data about detected objects from the anti-virus tool 110. At step 602, the received data is processed and structured in a form convenient for storage and further analysis in the data storage device 220. The processed data is accumulated in the data storage device in step 603. C by a small periodicity, for example, once every few hours, the false positive analysis tool performs an operational analysis of the accumulated data at step 604, after which a database of correction coefficients is formed on the antivirus server torona in step 605.

The false positive analysis tool 230 at step 606 performs a general analysis of the data on the positives accumulated over a long period of time, for example, a week. As a result of a general analysis of false positives, a rule base is formed on the side of the anti-virus server at step 607. After that, the base of correction factors and the rule base are available for download and update.

As a result of the system’s work, data is collected on detected malicious objects, triggered rules and set ratings coming from the user's computer. The bases for correcting coefficients and rules are being prepared based on these data for those rules that entailed false positives at harmless objects. Through the use of a database of correction factors, as well as through a change in the rules, a reduction in the number of false alarms of the system at harmless objects during anti-virus scanning is achieved.

7 is an example of a general purpose computer system, a personal computer or server 20 comprising a central processor 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processor 21. The system bus 23 is implemented like any bus structure known in the art, which in turn contains a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interacting with any other bus architecture. The system memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS), contains the basic procedures that ensure the transfer of information between the elements of the personal computer 20, for example, at the time of loading the operating system using ROM 24.

The personal computer 20 in turn contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29, and an optical drive 30 for reading and writing to removable optical disks 31, such as a CD-ROM, DVD -ROM and other optical information carriers. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 through the interface of the hard disk 32, the magnetic disk drive interface 33 and the optical drive interface 34, respectively. Drives and associated computer storage media are non-volatile means of storing computer instructions, data structures, software modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk, a removable magnetic disk 29 and a removable optical disk 31, but it should be understood that other types of computer storage media are possible that can store data in a form readable by a computer (solid state drives, flash cards memory, digital disks, random access memory (RAM), etc.).

Computer 20 has a file system 36 where the recorded operating system 35 and additional software applications 37, other software modules 38 and program data 39 are stored. The user is able to enter commands and information into the personal computer 20 via input devices (keyboard 40, mouse pad) 42). Other input devices (not displayed) can be used: microphone, joystick, game console, scanner, etc. Such input devices are, as usual, connected to the computer system 20 via a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer can be equipped with other peripheral output devices (not displayed), for example, speakers, a printer, etc. .

The personal computer 20 is capable of operating in a networked environment, using a network connection with another or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the creature personal computer 20 shown in Fig.7. Other devices, such as routers, network stations, peer-to-peer devices, or other network nodes may also be present on the computer network.

Network connections can form a local area network (LAN) 51 and wide area network (WAN) 52. Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local area network 51 via a network adapter or network interface 53. When using the networks, the personal computer 20 may use a modem 54 or other means of providing communication with a global computer network 52, such as the Internet. The modem 54, which is an internal or external device, is connected to the system bus 23 via the serial port 46. It should be clarified that the network connections are only exemplary and are not required to display the exact network configuration, i.e. in reality, there are other ways to establish a technical connection between one computer and another.

It should be noted that the examples given in the description are explanatory and are not intended to limit the scope and essence of the claimed utility model, which are established in the attached formula.

Claims (8)

1. A system for analyzing false positives of an anti-virus system, including an anti-virus server connected to at least one personal computer of the user, while the personal computer of the user includes: a) an antiviral agent associated with the following agents: - a base of rules on the side of the user's personal computer; - a base of correction factors on the side of the user's personal computer; - update tool on the side of the user's personal computer; - a means of generating reports on an anti-virus server; at the same time, the mentioned antivirus tool is designed to check the processes that are called up when objects are launched using the rule base and the base of correction factors; b) update tool on the side of the user's personal computer associated with the following tools: - the basis of the rules on the side of the user's personal computer; - a base of correction factors on the side of the user's personal computer; - update tool on the anti-virus server side; wherein said update tool on the side of the user's personal computer is configured to be launched by an anti-virus tool and is intended to update the rule base and the database of correction factors received from the update tool on the anti-virus server side; c) the rule base on the side of the user's personal computer, which contains a set of rules for detecting malicious objects; d) the base of correction factors on the side of the user's personal computer, which contains a set of correction factors for the rules from the rule base; the anti-virus server includes: I) a reporting tool associated with a data storage means, wherein said reporting tool is configured to receive data from an anti-virus tool on a user's computer and based on the received reporting data; II) data storage means associated with a false positive analysis means, wherein said data storage means is intended for storing reports received from the reporting means; III) means of analysis of false positives associated with the following means: - a means of storing a black list; - a base of correction factors on the anti-virus server side; - a rule base on the anti-virus server side; the said false positive analysis tool is intended to analyze the data contained in the data storage tool, using the checksums in the blacklist storage tool for analysis, is also intended to form a database of correction factors and a rule base based on the analysis, which allows to reduce the number of false positives of the anti-virus system; Iv) said blacklist storage facility containing checksums of known malicious objects; V) an anti-virus server-side update tool associated with the following tools: - a rule base on the anti-virus server side; - a base of correction factors on the anti-virus server side; however, the said update tool on the anti-virus server side is configured to send a new version of the rule base on the anti-virus server side and the correction coefficient database on the anti-virus server side when the update tool is requested on the user's personal computer. VI) the mentioned rule base on the anti-virus server side, containing a set of rules updated as a result of the operation of the false positive analysis tool; VII) said base of correction coefficients on the anti-virus server side, containing a set of correction coefficients for the rules from the said rule base, updated as a result of the operation of the false positive analysis tool; 2. The system according to claim 1, in which the antivirus tool is configured to transmit to the reporting tool data containing at least the checksum of the found object on which the rule worked, the rule number that worked, the process rating set by the rule, and the overall rating process. 3. The system according to claim 1, in which the checked processes are processes that are called when objects are launched in the operating system of the user's personal computer. 4. The system according to claim 1, in which the malicious object is the object that caused the process to receive a rating that is higher than the hazard rating as a result of an anti-virus scan. 5. The system according to claim 1, in which the base of correction factors and the base of rules are made with the possibility of independent updates. 6. The system according to claim 1, in which the antivirus tool is configured to complete the process caused by the malicious object upon detection of the malicious object. 7. The system according to claim 1, in which the said means of analysis of false positives is made with the possibility of operational analysis to form the base of correction factors on the side of the anti-virus server. 8. The system of claim 1, wherein said means of analyzing false positives is configured to perform a general analysis to form a rule base on the anti-virus server side.