Antivirus DFA Virus Engine Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus technologies are inadequate in detecting polymorphic and metamorphic viruses due to their reliance on slow scanning methods and inability to handle complex virus code obfuscation, leading to inefficiencies and false positives.
Innovation Solution
An antivirus mechanism that builds a Deterministic Finite Automaton (DFA) based on virus patterns to scan binary files using disassembly codes, allowing for exact detection of virus engines by matching disassembly codes with a database, thereby improving scanning speed and detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If scan string method is used to detect viruses, then detection capability is provided, but scanning speed becomes too slow
Solution Approach 1:
The patent segments the file scanning process into multiple parallel threads, where each thread independently scans different portions of the file using scan strings. This parallelization maintains comprehensive virus detection coverage while significantly improving scanning speed by utilizing multi-core processor capabilities.
Solution Approach 2:
The patent performs preliminary actions by building optimized scan string databases beforehand and pre-processing file headers to identify potential virus signatures early in the scanning process. This allows the main scanning operation to focus on critical sections, improving overall scanning efficiency without compromising detection accuracy.
2Reliability
If byte searching method is used to search for virus patterns, then virus detection is achieved, but scanning performance drops significantly on large files
Solution Approach 1:
The patent applies local quality by focusing byte searching operations only on specific critical sections of the file rather than scanning the entire file. By identifying and prioritizing scanning of header sections, code segments, and other suspicious areas while reducing scrutiny of benign sections, the system maintains high detection accuracy for viruses while improving scanning performance on large files.
3Measurement precision
If manual decryption is used to detect polymorphic and metamorphic viruses, then detection accuracy improves, but scanning time overhead increases
Solution Approach 1:
The patent applies partial action by performing manual decryption only on suspicious sections of the file where polymorphic or metamorphic viruses are most likely to be hidden, rather than decrypting the entire file. This selective approach maintains high detection accuracy for these sophisticated viruses while minimizing the time overhead associated with decryption operations.
4Reliability
If emulator is used to monitor virus code execution, then virus detection is possible, but scanning speed suffers due to do-nothing loops
Solution Approach 1:
The patent extracts and removes do-nothing loops and other non-instructional code segments from the emulation process. By identifying and skipping these redundant loops that provide no useful information for virus detection, the system maintains its ability to detect viruses through code execution monitoring while significantly improving scanning speed.
Data Source
AI summary
In one embodiment, an antivirus mechanism builds an automaton of a virus using a pattern and a set of rules. The antivirus mechanism may then scan a binary file to detect an engine of the virus by matching the automaton with a plurality of disassembly codes derived from the binary file. The pattern may comprise a data structure including a name of a particular virus, and information for detecting the virus using the disassembly codes.