Discrete Finite Automata Graph Traversal for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity and volume of processes and files on modern computers make it computationally infeasible to efficiently search for malicious patterns and relationships within graph data structures, hindering the detection and classification of malware.
Innovation Solution
A method that utilizes a discrete finite automaton (DFA) to traverse graph data structures efficiently, allowing for the specification of patterns using a compact and expressive query language, starting at a pre-specified entry-point node, which reduces the time required for searches and increases flexibility compared to traditional techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional search methods are used to locate malicious processes or files, then the search can be performed on all processes and files, but the search becomes very time-consuming and resource-intensive
Solution Approach 1:
The patent segments the search space by organizing processes and files into a graph data structure with hierarchical relationships. The discrete finite automaton divides the traversal into targeted paths based on malware patterns, rather than exhaustively searching all processes and files. This segmentation allows the system to focus computational resources on relevant portions of the graph, significantly reducing search time while maintaining detection accuracy.
Solution Approach 2:
The patent performs preliminary actions by pre-compiling malware detection patterns into a discrete finite automaton before the actual search. The automaton is constructed in advance with predefined states and transitions that represent known malware behaviors and characteristics. This preliminary preparation enables the search algorithm to efficiently match observed processes and files against pre-defined malware patterns without requiring complex runtime analysis, thus reducing search time while preserving reliability.
2Reliability
If traditional search methods are used to locate malicious processes or files, then the search can be performed on all processes and files, but the computational resources required become excessive
Solution Approach 1:
The graph data structure segments the computational task into manageable units representing processes, files, and their relationships. The discrete finite automaton further segments the traversal by following only those paths that match malware patterns, avoiding exhaustive exploration of the entire graph. This segmented approach reduces computational resource consumption by focusing processing power on relevant subgraphs rather than the complete process and file space.
Solution Approach 2:
The discrete finite automaton serves as an intermediary between the graph data structure and the malware detection logic. Instead of directly analyzing each process and file against complex malware signatures, the automaton mediates the search by translating graph traversals into pattern matches. This intermediary layer simplifies the computational burden by pre-structuring the detection logic, thereby reducing energy consumption while maintaining detection accuracy.
3Adaptability or versatility
If a compact and expressive query language is used to specify patterns, then the flexibility and expressiveness of pattern specification is improved, but the complexity of the search algorithm increases
Solution Approach 1:
The patent replaces complex mechanical search algorithms with a discrete finite automaton model. The query language specifications are translated into automaton states and transitions, transforming the search problem from a complex algorithmic challenge into a formal language recognition problem. This substitution leverages well-established automaton theory and optimization techniques, reducing the effective complexity of implementing flexible pattern matching while maintaining high adaptability through the expressive query language.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Example techniques herein search a graph data structure and retrieve data associated with a result node or edge. The graph can include nodes representing, e.g., processes or files, and edges between the nodes. A control unit can produce a discrete finite automaton (DFA) based on a query. The control unit can traverse the DFA in conjunction with the graph, beginning at an initial state of the DFA and an entry-point node of the graph, to reach a result node of the graph associated with a triggering state of the DFA. Traversal can include unwinding upon reaching a terminal state of the DFA, in some examples. The control unit can retrieve data associated with the result node or an edge connected there to, and can provide the data via a communications interface. A data-retrieval system can communicate with a data-storage system via the communications interface, in some examples.