Archive PE File Virus Detection via Multi-Stage Hash Analysis

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing stream-based virus detection methods for PE files cannot effectively determine whether an Archive file carries a virus, as they incorrectly detect Archive-type files and fail to differentiate between virus files and non-virus files.

Innovation Solution

Extract identification information from both the PE file header and the data part of the Archive file using hash algorithms like MD5, and match it with prestored virus identification information in an antivirus database to determine if the Archive file is a virus file.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If virus detection is performed only on PE file header structure information, then detection speed is improved, but detection accuracy deteriorates for Archive files

Engineering Contradiction:
Improvedetection speedVSAvoiddetection accuracy
Core Design Contradiction:
SpeedVSMeasurement precision

Solution Approach 1:

The detection process is segmented into two stages: first, extract and match identification information from the PE file header structure to quickly identify potential Archive files; second, for files identified as Archive type, perform additional extraction and matching of identification information from the data part. This segmentation allows fast detection for regular files while providing enhanced detection for Archive files.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The method performs preliminary extraction of identification information from the PE file header structure before processing the entire file. This preliminary action enables the system to quickly identify Archive files and apply appropriate detection strategies, improving overall detection efficiency while maintaining accuracy for file types that require deeper analysis.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If virus detection is performed on Archive files using only header information, then false positive rate increases, but detection coverage is improved

Engineering Contradiction:
Improvefalse positive rateVSAvoiddetection coverage
Core Design Contradiction:
ReliabilityVSQuantity of substance

Solution Approach 1:

The detection method applies different quality levels of analysis to different parts of Archive files. The PE file header structure receives standard identification information extraction, while the data part receives additional identification information extraction. This local quality differentiation ensures that Archive files are analyzed with sufficient depth to reduce false positives, while maintaining detection coverage across all file regions.

Inventive Principle:
Principle #3Local quality

3Productivity

If stream-based detection is used for PE files, then processing efficiency is improved, but ability to detect Archive files deteriorates

Engineering Contradiction:
Improveprocessing efficiencyVSAvoidArchive file detection ability
Core Design Contradiction:
ProductivityVSReliability

Solution Approach 1:

The stream-based detection method is enhanced to perform multiple functions: it can detect regular PE files using header structure information, identify Archive files through header analysis, and then perform additional data part analysis on Archive files. This multi-functionality allows the single stream-based approach to handle both regular PE files and Archive files effectively, maintaining processing efficiency while improving Archive file detection capability.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP2924943B1Virus detection method and device
Publication Date: 2018.03.14 HUAWEI TECH CO LTD
  • EP2924943B1 patent drawingFigure 1~2
  • EP2924943B1 patent drawingFigure 3
  • EP2924943B1 patent drawingFigure 4~5

AI summary

A virus detecting method and device, where the method includes: receiving a network data stream carrying a PE file; calculating first identification information according to structure information of the PE file; matching the first identification information with virus identification information prestored in an antivirus database, and determining whether the PE file is an Archive file; if the PE file is an Archive file, calculating second identification information according to the data packet that carries a data part of the Archive file; and matching the second identification information with the virus identification information prestored in the antivirus database, and if the matching succeeds, determining that the Archive file is an Archive virus file. The present invention can effectively determine whether an Archive-type PE file is a virus file.