Adaptive Recursive Filtering for Malware Sample Submission
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile and embedded devices with intermittent connectivity face challenges in submitting malware samples for analysis due to bandwidth constraints and the risk of disconnection during transmission, especially with the increasing need for unique and full sample submissions amidst targeted malware threats.
Innovation Solution
An adaptive and recursive filtering system that splits samples into portions, uses hashes to determine known content, and only transmits unknown portions to the server, employing pre-shared rules and filtering techniques to optimize data transmission and minimize bandwidth usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire sample is submitted from a mobile device with intermittent connectivity, then the server receives complete data for analysis, but the transmission may be invalidated due to disconnection and bandwidth is excessively consumed
Solution Approach 1:
The sample is divided into multiple portions or chunks, allowing selective transmission of only those portions that are not already known to the server. This segmentation enables the system to submit partial data reliably without requiring complete sample transmission, thereby reducing bandwidth consumption while maintaining submission reliability.
Solution Approach 2:
The system extracts and transmits only the unknown or novel portions of the sample that need to be analyzed, rather than transmitting the entire sample. This extraction approach eliminates redundant data transmission and focuses bandwidth on the essential unknown content.
2Loss of information
If the entire sample is submitted in full, then complete data is available for malware analysis, but transmission time is excessive and user experience is degraded
Solution Approach 1:
By segmenting the sample into portions and identifying which portions are already known to the server through hashing, the system transmits only the unknown segments. This significantly reduces transmission time while ensuring that all necessary unknown information is preserved for complete malware analysis.
Solution Approach 2:
The system performs preliminary hashing and comparison of sample portions against the server's known database before transmission. This preliminary action identifies which portions need to be sent, allowing the system to prepare and transmit only the necessary data, thereby reducing transmission time while maintaining data completeness.
3Loss of energy
If sample submission is optimized to send only unknown portions, then bandwidth consumption is reduced, but the system complexity increases due to filtering and hashing mechanisms
Solution Approach 1:
The system uses hashing to create compact representations (copies) of sample portions for comparison with the server's database. This copying mechanism allows efficient identification of unknown portions without requiring complex filtering logic, as the hash comparison process is computationally simple and lightweight.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Disclosed are systems, apparatuses, computer readable media, and methods of using an adaptive (i.e., learning) client-server system to enhance the efficiency of sample submissions, e.g., the submission of samples of malware programs to a server dictionary. The server in such a system may accumulate a dictionary of known programs and/or portions of programs that have been submitted by many different client devices over time, representing all the various programs that they have encountered. If a portion of a particular file submission is already available to the server (i.e., it is a portion that the server has already analyzed and stored), it will be excluded from future sample transmissions. The server will gradually accumulate a rich dictionary of common program portions, thus requesting transmission only of previously unseen portions. Such systems, apparatuses, computer readable media, and methods may therefore be used to reduce transmission times needed for future sample submissions.