Software Basic Block Similarity Analysis for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems, relying on file signature scanning, struggle to identify similarities between malware variants caused by code reuse, as they do not effectively detect similarities in compiled binary code, limiting their ability to determine the provenance of new malware variants.
Innovation Solution
A computing device is configured to analyze software by determining similarity values between normalized code segments using an n-gram analysis algorithm, generating probabilistic hash fingerprints, and filtering out known-good code segments, allowing for the identification of related software and potential malware through code reuse detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If file signature scanning is used to detect malware, then detection speed is maintained, but detection precision deteriorates because similarities between malware variants caused by code reuse are not detected
Solution Approach 1:
The patent segments the malware binary code into basic blocks (contiguous sequences of instructions) and then divides each basic block into n-grams (subsequences of instructions). This segmentation enables detailed comparison of code structures at multiple levels, allowing detection of similarities caused by code reuse while managing complexity through hierarchical analysis.
Solution Approach 2:
The patent replaces traditional file signature scanning (mechanical pattern matching) with n-gram analysis and probabilistic hash fingerprinting. This substitution enables detection of code reuse by comparing instruction sequences and their permutations, significantly improving detection precision for malware variants while maintaining automated analysis capabilities.
2Measurement precision
If manual examination of textual strings or domain names is performed to determine malware provenance, then detection precision improves, but productivity deteriorates due to time-consuming analysis
Solution Approach 1:
The patent replaces manual examination of textual strings with automated n-gram analysis of binary code instructions. The system extracts instruction sequences, generates probabilistic hash fingerprints, and compares them across malware samples automatically. This substitution maintains high precision in provenance determination while enabling batch processing of numerous malware variants.
Solution Approach 2:
The patent creates probabilistic hash fingerprints as compact representations of code segment similarities. These fingerprints serve as copies that capture essential similarity information without requiring full binary comparison, enabling rapid provenance determination across large numbers of malware samples while maintaining accuracy.
3Adaptability or versatility
If sliding window hashes are used to determine compiled binary code similarity, then detection capability improves, but measurement precision deteriorates because false positives occur
Solution Approach 1:
The patent applies different analysis methods to different code structures. Basic blocks with similar instruction sequences receive detailed n-gram analysis, while other regions use probabilistic hash fingerprinting. This local quality approach improves measurement precision by applying the most appropriate method to each code segment, reducing false positives while maintaining detection capability.
Solution Approach 2:
The patent changes the parameters of hash analysis by using n-grams of varying lengths and probabilistic hashing instead of fixed sliding window hashes. This allows the system to capture both exact matches and permuted sequences of instructions, improving code reuse detection precision while reducing false positives through multiple comparison dimensions.
Data Source
AI summary
Technologies for analyzing software similarity include a computing device having access to a collection of sample software. The computing device identifies a number of code segments, such as basic blocks, within the software. The computing device normalizes each code segment by extracting the first data element of each computer instruction within the code segment. The first data element may be the first byte. The computing device calculates a probabilistic feature hash signature for each normalized code segment. The computing device may filter out known-good code segments by comparing signatures with a probabilistic hash filter generated from a collection of known-good software. The computing device calculates a similarity value between each pair of unfiltered, normalized code segments. The computing device generates a graph including the normalized code segments and the similarity values. The computing device may cluster the graph using a force-based clustering algorithm.