Automatic Malware Defense Through Binary Branch Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems struggle to effectively defend against unknown malware files, leading to potential security risks due to delayed human analysis or excessive system lockdowns.
Innovation Solution
Automatically identify the closest known malware binary file (KMBF) to an unknown suspect binary file (SBF) through branch mapping, API profiling, or a combination of both, to implement a suitable defense strategy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If human analysts manually assess unclassifiable unknown files, then classification accuracy improves, but response time deteriorates causing security delays
Solution Approach 1:
The system performs preliminary automated classification of unknown files using multiple malware detection engines and heuristics before human analyst review. This pre-processing step filters out clearly benign or malicious files, preparing cases more effectively for human assessment and reducing overall response time while maintaining accuracy for complex cases
Solution Approach 2:
An automated triage system acts as an intermediary between initial file detection and human analyst assessment. This intermediary layer performs preliminary analysis, categorization, and prioritization, enabling human analysts to focus only on the most critical or ambiguous cases, thus reducing their workload and improving overall response time
2Reliability
If the system locks down the network during human analysis, then security reliability improves, but system productivity deteriorates due to unnecessary restrictions
Solution Approach 1:
Instead of complete network lockdown, the system applies partial containment measures targeted specifically at the suspicious file or process. Isolated containment actions are taken only where necessary, allowing the rest of the network to continue operating normally, thus maintaining productivity while ensuring security reliability through focused intervention
Solution Approach 2:
The system applies different containment strategies to different suspicious files based on their specific risk profiles. Rather than uniform network-wide lockdown, localized containment measures are implemented targeting only the specific threat, allowing unaffected systems to maintain full productivity while security reliability is preserved through targeted action
3Productivity
If the system assumes unclassifiable files are benign, then system productivity improves by avoiding lockdowns, but security reliability deteriorates due to potential missed threats
Solution Approach 1:
The system applies preliminary defensive measures such as sandboxing or restricted execution environments to unclassifiable files before determining their benign nature. This preliminary anti-action prevents potential threats from affecting the system while allowing further analysis, thus maintaining security reliability without permanent productivity loss from full lockdowns
Solution Approach 2:
The system dynamically adjusts its response to unclassifiable files based on ongoing analysis results. Files start in a restricted state that limits potential harm, but as analysis progresses and confidence increases, restrictions are gradually lifted. This dynamic approach maintains security reliability during uncertainty while restoring productivity once the file is confidently classified as benign
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
One aspect relates to a computer-implemented method of automatically securing a computer system or network against a suspect binary file (SBF) by, in response to detection of the SBF, initiating an automatic defence strategy comprising an action known to mitigate a known threat posed by a closest known malicious binary file (KMBF), the method further comprising: identifying the closest KMBF from a plurality of KMBFs by comparing an SBF branch map generated in respect of the SBF with respective KMBF branch maps generated in respect of each of the plurality of KMBFs, the SBF and KMBF branch maps being generated by breaking each of the respective binary files down into a respective sequence of blocks and determining how each block of the sequence branches to one or more other blocks of the sequence. Further aspects relate to corresponding data processing systems, computer programs, computer-readable data carriers and data carrier signals.