Compound File Detection via Header and Directory Feature Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus solutions are inadequate in detecting polymorphous malicious compound files, which are created through automated generation and have different file bodies but similar functionality, as they rely on signature or heuristic analysis that may not effectively identify these files.
Innovation Solution
A system and method that involves obtaining compound files, identifying features associated with their headers and directories, calculating a hash sum based on these features, and comparing it with a database to classify the files as malicious, trusted, or untrusted, allowing for effective detection and potential removal or quarantine of malicious files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If signature analysis is used for detection, then detection speed is improved, but detection effectiveness against polymorphous malicious files deteriorates
Solution Approach 1:
The patent segments the compound file into multiple components: header, directories, and content. Instead of analyzing the entire file at once (which would be slow), it extracts and analyzes only the header and directory features, which are small in size but contain critical identification information. This segmentation enables both fast processing and effective detection of polymorphous threats.
Solution Approach 2:
The patent applies local quality by focusing analysis on specific critical regions of the file (header and directories) rather than the entire file content. The header contains fundamental file structure information and the directories contain references to embedded objects, both of which remain relatively stable across polymorphous variations. This localized analysis maintains detection effectiveness while improving speed.
2Adaptability or versatility
If heuristic analysis is used for detection, then detection coverage is improved, but applicability to all file types deteriorates
Solution Approach 1:
The patent creates a universal detection method that works across multiple compound file formats (MS-CFB, Office Open XML, etc.) by identifying common structural elements (headers and directories) that exist in all these formats. The approach extracts features from these universal structural components rather than format-specific content, enabling consistent application across diverse file types while maintaining reliability.
3Measurement precision
If full file content analysis is performed, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent extracts only the essential identifying features from the compound file - specifically the header information and directory structure - while excluding the large content portion. These extracted features contain sufficient information to generate a hash sum for comparison with known malicious files, achieving accurate detection without the time cost of analyzing the entire file content.
Data Source
AI summary
A method and system is provided for detecting malicious compound files. An example method includes: obtaining at least one compound file; identifying a first set of features of the at least one compound file including features associated with a header of the at least one compound file; subsequent to identifying the first set of features, identifying, by the processor, a second set of features of the at least one compound file including features associated with at least one directory of the at least one compound file; determining a hash sum of the at least one compound file based on the first and second set of features; comparing the hash sum of the at least one compound file with information associated with a plurality of compound files stored in a database; and identifying the at least one compound file as being malicious, trusted or untrusted based at least on comparison results.