Executable File Malware Classification via Call Graph Pattern Digests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods, relying on digests like MD5 and SHA256, are limited in classifying malware due to their one-to-one relationship with files, making it difficult to correlate and classify malware effectively, and thus require additional hashing algorithms or tools like ssdeep, TLSH, and diffing tools for similarity analysis.
Innovation Solution
A cybersecurity server generates a call graph pattern from an executable file, calculates a digest using a fuzzy hashing algorithm like TLSH, and compares it to malicious digests to classify the file, enabling effective malware classification and family identification by measuring similarity between digests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional digest algorithms (MD5, SHA256) are used for malware detection, then detection speed is fast and implementation is simple, but malware classification capability is limited due to one-to-one relationship
Solution Approach 1:
The patent segments the executable file into multiple functions and represents them as vertices in a call graph. Each function is analyzed individually and then aggregated into a call graph pattern, enabling both efficient processing (segmentation advantage) and comprehensive classification capability (aggregation benefit).
Solution Approach 2:
The patent transitions from traditional one-dimensional hash digests to a multi-dimensional call graph pattern representation. The call graph pattern captures functional relationships, calling sequences, and control flow structures, adding dimensions of analysis that enable superior malware classification while maintaining computational efficiency through systematic processing.
2Adaptability or versatility
If multiple hashing algorithms (ssdeep, TLSH, imphash) are used for similarity analysis, then malware classification capability is improved, but system complexity increases
Solution Approach 1:
The call graph pattern serves as a universal representation that captures multiple aspects of executable functionality (control flow, function relationships, calling sequences) in a single structured format. This multi-functional representation eliminates the need for multiple specialized hashing algorithms while providing comprehensive malware classification capability.
Solution Approach 2:
The call graph pattern combines multiple types of information (function vertices, edge relationships, traversal sequences) into a composite representation. This composite structure integrates various analytical dimensions into one unified pattern that can be processed by a single digest algorithm, reducing system complexity while maintaining high classification capability.
3Measurement precision
If diffing tools (BinDiff, Diaphora) are used for file comparison, then similarity detection accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary analysis by generating the call graph pattern and its digest before comparison operations. This pre-processing creates a compact representative signature that captures essential functional characteristics, enabling rapid subsequent comparisons without requiring full diffing tool execution each time.
Solution Approach 2:
Instead of performing complex diffing operations on entire executable files, the patent creates a simplified copy or representation (the call graph pattern digest) that preserves essential similarity characteristics. This copied representation enables fast comparison while maintaining the ability to detect similarities that traditional diffing tools would identify.
Data Source
AI summary
A cybersecurity server receives an executable file to be classified. A call graph of the executable file is generated. Functions of the executable file are represented as vertices in the call graph, and a vertex value is generated for each vertex. The vertex values are arranged in traversal order of the call graph to generate a call graph pattern. A digest of the call graph pattern is calculated and compared to one or more malicious digests.