Cluster Signature Generation for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus systems rely on blacklists of known malicious software, which can be evaded by attackers making subtle changes to malware, leading to detection evasion.
Innovation Solution
A data analysis platform that transforms files using a space-filling curve, down-samples the result, and performs hashing to generate a cluster signature, allowing for the identification of similar files regardless of minor changes, thereby enhancing detection capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If blacklists of known malicious software are used for detection, then detection of known malware is improved, but detection evasion through subtle changes becomes possible
Solution Approach 1:
The patent segments the file into multiple blocks and processes each block independently through the space-filling curve transformation. This segmentation allows the system to capture local patterns while being resilient to minor modifications in any single block, thereby maintaining detection accuracy while reducing evasion capability.
Solution Approach 2:
The patent applies space-filling curve transformation to map the one-dimensional file block sequence into a two-dimensional grid structure. This dimensional change enables the system to perceive global file structure patterns that are invariant to local modifications, effectively preventing evasion through subtle changes while maintaining high detection precision.
2Measurement precision
If exact matching of file hashes is used, then precise identification of known malware is achieved, but any modification to the malware causes detection failure
Solution Approach 1:
The patent transforms the file representation from raw bytes to a space-filling curve based structural signature, changing the parameter space from exact byte matching to pattern-based identification. This allows the system to maintain precise identification of malware families while becoming robust to minor modifications such as padding, encryption, or code obfuscation.
Solution Approach 2:
The patent creates a transformed copy of the file structure through space-filling curve mapping, which preserves the essential structural characteristics while being independent of the original byte sequence. This copied representation enables reliable detection even when the original file is modified, as the structural patterns remain invariant.
3Productivity
If traditional antivirus signatures are used, then detection speed for known threats is improved, but detection of evolved malware variants is reduced
Solution Approach 1:
The patent performs preliminary space-filling curve transformation and down-sampling to create a compact structural representation of the file before detection. This preliminary processing enables rapid comparison of structural patterns while capturing enough detail to distinguish between different malware variants, achieving both high detection speed and variant adaptability.
Data Source
AI summary
A plurality of clustered files is received. A first tile included in the plurality is selected and loaded into a suffix array. A chunk is located in a second file that is also present in the first file. A determination is made that the located chunk is present in a threshold number of additional files included in the plurality of clustered files. A signature is generated for the plurality of clustered files at least in part by using the chunk.