Archive Header Analysis for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious files within encrypted, compressed, and password-protected archive files are inefficient, often requiring decryption or decompression, which can expose sensitive information and are slow, and are not effective on gateway products or when scanning archive files on disk drives without opening them.
Innovation Solution
An anti-virus detection module that identifies archive files based on identification bytes and header information, extracting descriptive information such as checksums and file sizes to compare with detection signatures, allowing for rapid and accurate detection without decrypting or decompressing the files, and is applicable to various archive formats including ZIP and RAR.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If malware is detected by extracting and scanning files from encrypted archives, then detection accuracy is improved, but detection speed deteriorates and sensitive information may be exposed
Solution Approach 1:
The patent extracts only the necessary identification information (file names, checksums, sizes) from archive headers without decrypting or extracting the actual file contents. This selective extraction of metadata enables detection while avoiding the time-consuming process of full decryption and extraction, thus resolving the contradiction between detection accuracy and detection speed.
Solution Approach 2:
The patent performs preliminary analysis of archive headers and metadata before any decryption or extraction operations. By examining file names, checksums, and other identification information stored in the archive structure itself, the system can detect malware early in the scanning process, improving detection speed while maintaining accuracy.
2Reliability
If password recovery algorithms are used to decrypt archives for scanning, then detection capability is improved, but processing speed deteriorates significantly
Solution Approach 1:
The patent extracts detection-relevant information directly from the archive header and metadata structures without requiring password-based decryption. By taking out only the necessary identification data (file names, checksums, sizes) that are stored in plaintext or accessible portions of the archive structure, the system maintains detection capability while avoiding the slow password recovery process entirely.
3Reliability
If archives are opened and decrypted for scanning, then malware detection is improved, but security risk increases due to exposure of sensitive information
Solution Approach 1:
The patent extracts only the minimal necessary information (file names, checksums, sizes) from archive headers for detection purposes, without decrypting or extracting the actual file contents. This selective extraction maintains malware detection capability while minimizing security risk by never exposing sensitive encrypted data.
Solution Approach 2:
The patent uses archive metadata and headers as an intermediary layer for detection. Instead of directly accessing encrypted file contents, the system analyzes the intermediate header information that contains identification data, thereby maintaining detection effectiveness while preventing exposure of sensitive information through the encrypted payload.
4Measurement precision
If client-side detection methods are used, then detection accuracy is improved, but applicability to gateway products deteriorates
Solution Approach 1:
The patent implements a universal detection method that works across multiple platforms and product types including both client machines and gateway products. By analyzing archive headers and metadata rather than requiring full extraction or decryption, the system achieves consistent detection accuracy whether deployed on end-user systems or network gateways, thereby improving adaptability while maintaining precision.
Data Source
AI summary
Systems and methods for content filtering are provided. According to one embodiment, a type and structure of an archive file are determined. The archive file includes identification bytes that identify the type of archive file and header information both in unencrypted and uncompressed form and a file data portion containing contents of files in encrypted form, compressed form or both. The determination is based solely on the identification bytes and/or the header information. Based thereon, descriptive information, describing characteristics of the files, is extracted from the header information for each file. The descriptive information includes a checksum of the file in uncompressed form, a size of the file in uncompressed form and/or a size of the file in compressed form. A file is identified as being potentially malicious or undesired when a comparison of the descriptive information to detection signatures of known malicious or undesired files results in a match.