Discrete Finite Automata Graph Traversal for Malware Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

The increasing complexity and volume of processes and files on modern computers make it computationally infeasible to efficiently search for malicious patterns and relationships within graph data structures, hindering the detection and classification of malware.

Innovation Solution

A method that utilizes a discrete finite automaton (DFA) to traverse graph data structures efficiently, allowing for the specification of patterns using a compact and expressive query language, starting at a pre-specified entry-point node, which reduces the time required for searches and increases flexibility compared to traditional techniques.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional search methods are used to locate malicious processes or files, then the search can be performed on all processes and files, but the search becomes very time-consuming and resource-intensive

Engineering Contradiction:
Improvemalware detection accuracyVSAvoidsearch time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent segments the search space by organizing processes and files into a graph data structure with hierarchical relationships. The discrete finite automaton divides the traversal into targeted paths based on malware patterns, rather than exhaustively searching all processes and files. This segmentation allows the system to focus computational resources on relevant portions of the graph, significantly reducing search time while maintaining detection accuracy.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary actions by pre-compiling malware detection patterns into a discrete finite automaton before the actual search. The automaton is constructed in advance with predefined states and transitions that represent known malware behaviors and characteristics. This preliminary preparation enables the search algorithm to efficiently match observed processes and files against pre-defined malware patterns without requiring complex runtime analysis, thus reducing search time while preserving reliability.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If traditional search methods are used to locate malicious processes or files, then the search can be performed on all processes and files, but the computational resources required become excessive

Engineering Contradiction:
Improvemalware detection accuracyVSAvoidcomputational resource consumption
Core Design Contradiction:
ReliabilityVSUse of energy by moving object

Solution Approach 1:

The graph data structure segments the computational task into manageable units representing processes, files, and their relationships. The discrete finite automaton further segments the traversal by following only those paths that match malware patterns, avoiding exhaustive exploration of the entire graph. This segmented approach reduces computational resource consumption by focusing processing power on relevant subgraphs rather than the complete process and file space.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The discrete finite automaton serves as an intermediary between the graph data structure and the malware detection logic. Instead of directly analyzing each process and file against complex malware signatures, the automaton mediates the search by translating graph traversals into pattern matches. This intermediary layer simplifies the computational burden by pre-structuring the detection logic, thereby reducing energy consumption while maintaining detection accuracy.

Inventive Principle:
Principle #24Intermediary (Mediator)

3Adaptability or versatility

If a compact and expressive query language is used to specify patterns, then the flexibility and expressiveness of pattern specification is improved, but the complexity of the search algorithm increases

Engineering Contradiction:
Improvequery language flexibilityVSAvoidsearch algorithm complexity
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent replaces complex mechanical search algorithms with a discrete finite automaton model. The query language specifications are translated into automaton states and transitions, transforming the search problem from a complex algorithmic challenge into a formal language recognition problem. This substitution leverages well-established automaton theory and optimization techniques, reducing the effective complexity of implementing flexible pattern matching while maintaining high adaptability through the expressive query language.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentEP3416068B1Information retrieval using automata
Publication Date: 2025.01.08 CROWDSTRIKE
  • EP3416068B1 patent drawingFigure 1
  • EP3416068B1 patent drawingFigure 2
  • EP3416068B1 patent drawingFigure 3

AI summary

Example techniques herein search a graph data structure and retrieve data associated with a result node or edge. The graph can include nodes representing, e.g., processes or files, and edges between the nodes. A control unit can produce a discrete finite automaton (DFA) based on a query. The control unit can traverse the DFA in conjunction with the graph, beginning at an initial state of the DFA and an entry-point node of the graph, to reach a result node of the graph associated with a triggering state of the DFA. Traversal can include unwinding upon reaching a terminal state of the DFA, in some examples. The control unit can retrieve data associated with the result node or an edge connected there to, and can provide the data via a communications interface. A data-retrieval system can communicate with a data-storage system via the communications interface, in some examples.