Digital DNA Sequencing Engine for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies are inadequate in detecting variations of original files in memory (RAM), executables altered at runtime, and variants of malware protected by packers or encryptors, limiting their effectiveness in identifying and classifying malicious software.
Innovation Solution
A digital DNA sequencing engine that evaluates data objects in memory using a set of rules to generate a digital DNA sequence, classifying data objects by matching traits with predefined rules, and generating a sequence that indicates the presence of malware, spyware, or other suspicious content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional file hashing and signature-based detection methods are used, then known malware can be detected, but variations of original files in memory and altered executables cannot be detected
Solution Approach 1:
The patent segments the executable file into multiple sections (headers, imports, code segments, data segments) and analyzes each section independently to extract behavioral features. This segmentation enables detection of variations and alterations in specific parts of the executable without requiring the entire file to match a known signature, thus detecting both known malware and its variations.
Solution Approach 2:
The patent implements dynamic analysis by monitoring the executable's behavior during runtime, including memory allocations, function calls, and system interactions. This dynamic approach captures changes made at runtime and detects malware that modifies itself or uses obfuscation techniques, overcoming the limitation of static signature-based detection.
2Productivity
If static analysis methods are used, then detection speed is fast, but malware protected by packers or encryptors cannot be detected
Solution Approach 1:
The patent performs preliminary static analysis to identify packed or encrypted executables by detecting specific patterns, headers, and characteristics. When such executables are detected, the system automatically triggers dynamic analysis or unpacking procedures before final classification, ensuring that protected malware is properly analyzed without significantly impacting overall detection speed.
Solution Approach 2:
The patent introduces an intermediary analysis layer that bridges static and dynamic methods. This intermediary layer uses heuristic analysis and behavioral prediction to assess suspicious files that show signs of protection, deciding whether to proceed with full dynamic analysis or use alternative detection methods, thus maintaining both speed and effectiveness.
3Measurement precision
If comprehensive behavioral analysis is performed on all executables, then detection accuracy improves, but system performance and resource consumption increase
Solution Approach 1:
The patent applies local quality by performing comprehensive behavioral analysis only on specific suspicious sections of executables rather than the entire file. The system identifies and focuses analysis on critical areas such as import tables, code segments with unusual patterns, and memory allocation behaviors, reducing overall resource consumption while maintaining detection accuracy for malicious components.
Solution Approach 2:
The patent implements a tiered analysis approach where only the necessary portion of behavioral analysis is performed on each executable. Files are first screened with lightweight static checks, and only those triggering suspicion thresholds undergo more intensive dynamic analysis, optimizing the balance between detection accuracy and resource usage.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
In an embodiment of the invention, a method of classifying a data object includes: scanning the data object; evaluating contents of data objects base on at least one selected rule; and generating a digital DNA sequence that classifies at least some contents in the data object.