Cyber Threat Information Processing via Malware Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity technologies face challenges in detecting and responding to new or variant malware, particularly advanced persistent threats (APT) and decoy information, due to limitations in pattern-based detection methods and the lack of standardized descriptions of malware and attack techniques, leading to difficulties in identifying attackers and predicting future cyber threats.
Innovation Solution
A method involving the extraction of operation code (OP-CODE) and assembly code (ASM-CODE) combinations from executable files, clustering similar malwares, and performing dynamic analysis to generate network behavior information datasets, which determines similarity with network packet information to identify and respond to malware clusters, including variants and unknown threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If pattern-based detection methods are used to rapidly detect known malware, then detection speed and accuracy for known threats is improved, but the system becomes unable to detect new or variant malware including APT attacks
Solution Approach 1:
The patent segments malware analysis into multiple dimensions: code semantics (disassembled code analysis), static characteristics (file attributes, headers), and dynamic behaviors (runtime network and system activities). This multi-dimensional segmentation enables the system to detect malware through various特征, improving both known malware detection accuracy and new malware detection capability by not relying on a single detection approach
Solution Approach 2:
The patent introduces a new dimension of analysis by examining malware from multiple perspectives simultaneously - code level (disassembled instructions), file level (static attributes), and runtime level (dynamic behaviors). This dimensional expansion allows the system to detect malware that may evade traditional pattern matching by exhibiting unusual behavior patterns across one or more dimensions
2Extent of automation
If AI analysis is used to detect and analyze malware, then analysis capability is advanced, but the system cannot address decoy information or fake information designed to deceive detection systems
Solution Approach 1:
The patent implements feedback mechanisms where detection results from multiple analysis dimensions are cross-validated. The system compares code semantic analysis results with static characteristic analysis and dynamic behavior monitoring, creating a feedback loop that identifies inconsistencies. This multi-layered feedback approach helps distinguish genuine malware from decoy information by requiring consistent malicious indicators across multiple analysis dimensions
Solution Approach 2:
The patent introduces an intermediary validation layer that mediates between AI analysis results and final detection decisions. This intermediary layer cross-checks AI-generated detections against established behavioral patterns and multiple analysis dimensions, filtering out false positives caused by decoy information while preserving genuine threat detections
3Productivity
If conventional malware detection methods focus on detecting malware itself, then detection of known malware is effective, but the system cannot identify different attackers creating similar malware or predict future attacks
Solution Approach 1:
The patent makes the detection system multi-functional by enabling it to perform not only malware detection but also attacker identification and attack prediction. The same multi-dimensional analysis framework used for detecting malware is also applied to analyze attacker behaviors, coding patterns, and campaign characteristics, allowing a single system to serve multiple security intelligence functions simultaneously
Solution Approach 2:
The patent performs preliminary analysis of attacker patterns and behaviors during the malware detection process itself. By analyzing code semantics, static characteristics, and dynamic behaviors, the system proactively identifies attacker-specific patterns and predicts potential future attacks before they occur, rather than waiting for separate analysis phases
4Loss of information
If standardized methods for describing malware and attack techniques are implemented, then information normalization and sharing is improved, but the complexity of implementing and maintaining standardized taxonomies increases
Solution Approach 1:
The patent applies parameter changes by transforming diverse malware and attack technique descriptions into a standardized parameter-based taxonomy. Instead of maintaining complex textual descriptions, the system represents malware characteristics, attack techniques, and attacker behaviors as structured parameters that can be systematically categorized, compared, and shared across different security systems and organizations
Data Source
AI summary
A cyber threat information processing method, a device for processing cyber threat information, and a storage medium that stores a program for processing cyber threat information according to embodiments may generates one or more clusters of malware by analyzing and processing an executable file and performing clustering, and may provide information about the malware cluster related to a specific network based on a data set of network behavior information for each malware cluster, which is generated by performing dynamic analysis for the malware cluster.