Dynamic Search Condition Generation for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing threat hunting techniques struggle to accurately detect malware due to the ease with which communication destination domains and hash values can be changed, and the excessive limitation of exact match search conditions for file paths and registry keys.
Innovation Solution
An information processing apparatus and method that generates search conditions by reflecting the occurrence tendency of events from dynamic analysis results, using an event index to broaden the search range for rare events and exclude frequent events, thereby enhancing malware detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If search conditions use communication destination domain or hash value, then malware can be detected, but detection accuracy decreases because these values can be easily changed
Solution Approach 1:
The patent transforms static search parameters (exact domain names, hash values) into dynamic parameters based on occurrence tendencies. By analyzing how frequently events occur and changing the search criteria from fixed values to statistical patterns, the system maintains detection accuracy while adapting to malware variations.
Solution Approach 2:
The search conditions are made dynamic by incorporating occurrence tendency analysis. Instead of using staticIoCs, the system continuously updates search criteria based on the frequency and patterns of events observed during dynamic analysis, allowing the detection mechanism to adapt to changing malware behaviors.
2Measurement precision
If search condition requires exact match of file path and registry key, then false positives are reduced, but detection coverage decreases because target is excessively limited
Solution Approach 1:
The patent applies partial matching instead of exact matching for file paths and registry keys. By using occurrence tendency to determine the level of matching required, the system achieves a balance between precision and coverage, detecting malware variants without excessive false positives.
Solution Approach 2:
The matching criterion parameter is changed from exact match to occurrence-based partial match. The system adjusts the string matching threshold based on how frequently specific paths or keys appear in normal operations versus malware operations, enabling flexible detection coverage.
3Quantity of substance
If search condition is broad to cover malware variations, then detection coverage increases, but false positives increase reducing detection accuracy
Solution Approach 1:
The system uses occurrence tendency as feedback to adjust search conditions dynamically. By monitoring how often specific events occur during normal operations versus malware execution, the system refines search criteria to maintain high coverage while filtering out false positives through statistical analysis.
Data Source
AI summary
An information processing apparatus according to the present disclosure includes an event index generation unit configured to generate an event index using event information output from a terminal and a search condition generation unit configured to generate a search condition for extracting the terminal exhibiting a specific behavior using a dynamic analysis result generated based on events occurred during an operation of malware and the event index. The search condition generation unit is configured to generate the search condition by reflecting an occurrence tendency of the event included in the dynamic analysis result in the terminal.