Archive PE File Virus Detection via Multi-Stage Hash Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing stream-based virus detection methods for PE files cannot effectively determine whether an Archive file carries a virus, as they incorrectly detect Archive-type files and fail to differentiate between virus files and non-virus files.
Innovation Solution
Extract identification information from both the PE file header and the data part of the Archive file using hash algorithms like MD5, and match it with prestored virus identification information in an antivirus database to determine if the Archive file is a virus file.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If virus detection is performed only on PE file header structure information, then detection speed is improved, but detection accuracy deteriorates for Archive files
Solution Approach 1:
The detection process is segmented into two stages: first, extract and match identification information from the PE file header structure to quickly identify potential Archive files; second, for files identified as Archive type, perform additional extraction and matching of identification information from the data part. This segmentation allows fast detection for regular files while providing enhanced detection for Archive files.
Solution Approach 2:
The method performs preliminary extraction of identification information from the PE file header structure before processing the entire file. This preliminary action enables the system to quickly identify Archive files and apply appropriate detection strategies, improving overall detection efficiency while maintaining accuracy for file types that require deeper analysis.
2Reliability
If virus detection is performed on Archive files using only header information, then false positive rate increases, but detection coverage is improved
Solution Approach 1:
The detection method applies different quality levels of analysis to different parts of Archive files. The PE file header structure receives standard identification information extraction, while the data part receives additional identification information extraction. This local quality differentiation ensures that Archive files are analyzed with sufficient depth to reduce false positives, while maintaining detection coverage across all file regions.
3Productivity
If stream-based detection is used for PE files, then processing efficiency is improved, but ability to detect Archive files deteriorates
Solution Approach 1:
The stream-based detection method is enhanced to perform multiple functions: it can detect regular PE files using header structure information, identify Archive files through header analysis, and then perform additional data part analysis on Archive files. This multi-functionality allows the single stream-based approach to handle both regular PE files and Archive files effectively, maintaining processing efficiency while improving Archive file detection capability.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
A virus detecting method and device, where the method includes: receiving a network data stream carrying a PE file; calculating first identification information according to structure information of the PE file; matching the first identification information with virus identification information prestored in an antivirus database, and determining whether the PE file is an Archive file; if the PE file is an Archive file, calculating second identification information according to the data packet that carries a data part of the Archive file; and matching the second identification information with the virus identification information prestored in the antivirus database, and if the matching succeeds, determining that the Archive file is an Archive virus file. The present invention can effectively determine whether an Archive-type PE file is a virus file.