Binary Object Similarity Measurement via Pattern Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods fail to efficiently measure the similarity of diverse binary objects, such as files, based on their contents, especially when they have unlike names, sizes, and sources, making it difficult to detect malicious patterns like viruses or malware embedded in various files transmitted from controlled sources.
Innovation Solution
A method that determines digital signatures for each binary object, accesses a data store to identify and count matching patterns, and calculates a similarity score by analyzing the frequency and distribution of these patterns across multiple objects, allowing for the measurement of similarity among diverse files without relying on metadata like names, sizes, or sources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional methods are used to identify and block files, then the same or related files can be blocked from many sources, but malicious binary patterns embedded in diverse files transmitted from controlled sources cannot be detected
Solution Approach 1:
The patent segments binary files into fixed-size blocks and extracts digital signatures from each block. This segmentation allows the system to analyze content patterns independently of file metadata, enabling detection of malicious patterns across diverse file types while maintaining high detection accuracy
Solution Approach 2:
The patent creates a data store containing digital signatures from multiple files and uses these signatures to identify similar patterns across different files. By copying and comparing signature patterns rather than entire files, the system can detect malicious content in diverse files transmitted from controlled sources
2Measurement precision
If digital signatures are determined for every binary string in files, then similarity of diverse binary objects can be measured, but computational complexity and processing time increase
Solution Approach 1:
The patent divides files into fixed-size blocks and extracts digital signatures only from each block rather than processing entire files. This segmentation reduces computational complexity while maintaining measurement precision by focusing on characteristic patterns that indicate similarity
Solution Approach 2:
The patent transforms binary data into digital signature representations, changing the parameter space from raw binary content to condensed signature values. This parameter transformation enables efficient similarity measurement with reduced computational complexity
Data Source
AI summary
An apparatus, system, and method for measuring the similarity of binary objects is disclosed. The method determines at least one pattern signature in an Nth binary object, accessing a location in a similarity store which has object identifiers for each of the previous N−1 binary objects which contain the corresponding pattern, and writing the object identifier of the Nth binary object at that same location in the similarity store. Reporting the number of locations in similarity store which contain the object identifiers of two apparently diverse binary objects is a measure of similarity to each other.