Architecture-Agnostic Binary Clustering for Cross-Platform Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing popularity of IoT devices with LINUX-based operating systems has led to a surge in malicious ELF binary files across different processor architectures, making it difficult to identify and distinguish between them effectively.
Innovation Solution
A system that clusters binary files by reducing them to architecture-agnostic functions, generating digests using a fuzzy hashing algorithm like TLSH, and comparing these digests to identify similarities with known malicious files, thereby detecting malware variants.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional binary file analysis methods are used, then detection accuracy for single-architecture malware is maintained, but the ability to detect and cluster malware across different processor architectures deteriorates
Solution Approach 1:
The patent extracts and removes architecture-specific code sections from binary files, retaining only the architecture-agnostic functional components. This extraction process isolates the universal malicious functionality from architecture-dependent implementations, enabling cross-architecture detection while preserving malware identification accuracy through the use of cryptographic hashing on the extracted functional portions.
Solution Approach 2:
The patent creates a universal detection mechanism that functions across multiple processor architectures by analyzing architecture-agnostic portions of binary files. The system processes ELF, PE, and other binary formats uniformly, applying the same analysis methodology regardless of target architecture, thereby achieving both adaptability and precision simultaneously.
2Device complexity
If architecture-specific analysis is performed, then detailed malware characteristics are preserved, but the complexity of analyzing malware across multiple architectures increases
Solution Approach 1:
The patent segments binary file analysis into distinct components: architecture-agnostic sections (imports, exports, section headers, cryptographic hashes) and architecture-specific sections (instruction code). By analyzing only the segmented architecture-agnostic portions for clustering and identification, the system reduces analysis complexity while maintaining multi-architecture support.
Solution Approach 2:
The patent introduces cryptographic hashing as an intermediary mechanism that bridges different architectures. By converting architecture-agnostic functional portions into hash values, the system creates a architecture-independent representation that simplifies cross-architecture comparison and clustering without requiring architecture-specific analysis logic.
3Productivity
If all binary file components are analyzed, then comprehensive malware detection is achieved, but processing time and computational resources increase
Solution Approach 1:
The patent extracts only the essential architecture-agnostic components (imports, exports, section headers, and cryptographic hashes) required for reliable malware detection, excluding architecture-specific instruction code from analysis. This extraction maintains detection reliability by preserving all necessary identification features while improving processing speed by eliminating redundant architecture-dependent data.
Solution Approach 2:
The patent applies partial action by analyzing only the critical architecture-agnostic portions of binary files rather than performing exhaustive analysis of all components. This selective analysis of essential elements achieves sufficient detection reliability while significantly reducing computational overhead and processing time compared to complete binary analysis.
Data Source
AI summary
A target binary file is clustered by reducing the target binary file to its architecture-agnostic functions, which are converted into an input string. The target digest of the input string is calculated and compared to digests of malicious binary files. A cluster having digests of malicious binary files that are similar to the target digest is identified. In response to identifying the cluster, the target binary file is detected to be malicious and of the same malware family as the malicious binary files of the cluster.