Dynamic Malware Detection via Segmented Data Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity measures struggle to accurately detect harmful content, such as malware, in data due to obfuscation techniques that evade signature-based detection methods.
Innovation Solution
A method involving dynamic analysis where a user device receives harmful and clean patterns, determines patterns in given data, and selectively receives subsequent data portions based on the presence of malicious content, utilizing machine learning models for accurate identification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If signature-based detection methods are used to identify harmful content, then the detection process is simple and fast, but the detection accuracy deteriorates due to obfuscation techniques
Solution Approach 1:
The patent segments the data reception process into multiple portions, analyzing each portion dynamically as it arrives. This allows the system to perform pattern matching on smaller, manageable chunks rather than waiting for complete files, improving both speed and accuracy in detecting obfuscated malware.
Solution Approach 2:
The system dynamically adjusts its analysis approach based on the data being received, using machine learning models that adapt to different obfuscation techniques. The detection process transitions from static signature matching to dynamic behavioral analysis, resolving the contradiction between speed and accuracy.
2Measurement precision
If all data is received and analyzed before taking action, then detection accuracy improves, but device resources are inefficiently utilized
Solution Approach 1:
The system performs preliminary analysis on the first portion of data before receiving the complete dataset. By identifying suspicious patterns early in the reception process, the system can take preventive actions without waiting for full data accumulation, thus saving device resources while maintaining detection accuracy.
Solution Approach 2:
The patent implements partial analysis where only the necessary portion of data is analyzed to make a detection decision. The system analyzes the first portion of data sufficiently to detect malicious content, avoiding the energy cost of analyzing entire large datasets when threats are already identified in initial segments.
3Measurement precision
If dynamic analysis with machine learning models is implemented, then detection accuracy improves, but device complexity increases
Solution Approach 1:
The patent divides the complex machine learning analysis into segments corresponding to data portions. Each segment is analyzed independently with appropriate computational resources, reducing the peak complexity burden on the device while maintaining overall detection accuracy through cumulative analysis.
Data Source
AI summary
A method including analyzing affected data known to include harmful content, and clean data known to be free of the harmful content; determining, based on analyzing the affected data and the clean data, harmful traits that appear in the affected data with a frequency that satisfies a threshold frequency, and clean traits that appear in the clean data with the frequency that satisfies the threshold frequency; mixing the harmful traits and the clean traits to determine a mixed set; analyzing the affected data based on utilizing the mixed set to determine a harmful pattern that indicates characteristics associated with the harmful traits and the clean traits; and transmitting pattern information indicating the harmful pattern to enable the user device to determine whether given data includes the harmful content is disclosed. Various other aspects are contemplated.