Encrypted Malware Detection via Segmented Signature Relationship Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems struggle to identify encrypted malware, as they often require specific signatures to decrypt and match encrypted patterns, which can be time-consuming and inefficient, especially for zero-day threats where new permutations of malware are not yet recognized.
Innovation Solution
A method and system that divide data and signatures into segments, apply relationship functions to these segments, and compare the results to determine if the data contains encrypted malware, allowing for detection without knowing the encryption key, enabling zero-day detection and rapid signature search over encrypted content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional signature matching is used to detect malware, then detection accuracy for known malware is improved, but detection capability for encrypted malware and zero-day threats deteriorates
Solution Approach 1:
The patent divides the malware signature into multiple segments and divides the encrypted data into corresponding segments. Instead of attempting to match the entire encrypted signature at once, the system processes individual segments independently, applying relationship functions to each segment pair to identify matching patterns even within encrypted content.
Solution Approach 2:
The patent transforms the detection approach by changing from direct signature matching to relationship function comparison. It applies mathematical relationship functions (such as XOR operations or other cryptographic relationships) to both signature segments and data segments, then compares the transformed results to detect encrypted malware without requiring decryption.
2Object-affected harmful factors
If encryption is used to protect malware, then malware concealment is improved, but detection efficiency deteriorates due to time-consuming decryption requirements
Solution Approach 1:
The patent converts the harmful effect of encryption (which hides malware content) into a beneficial detection mechanism. By applying the same relationship functions to both the encrypted signature and the encrypted data, the system can detect malware while it remains encrypted, turning the concealment feature into a detectable pattern without requiring decryption.
Solution Approach 2:
The patent introduces relationship functions as an intermediary mechanism between the encrypted signature and the detection process. Instead of directly comparing encrypted bytes or decrypting the content, the system uses relationship functions as a mediator to compare structural or mathematical relationships, enabling efficient detection without breaking encryption.
3Adaptability or versatility
If comprehensive signature updates are performed frequently to detect new malware permutations, then detection coverage is improved, but system complexity and resource consumption worsen
Solution Approach 1:
The patent creates a universal detection mechanism that works with multiple types of malware and encryption methods through the relationship function approach. The same segmentation and relationship function comparison methodology can detect various malware permutations without requiring separate detection algorithms, reducing the need for constant signature updates and system complexity.
Data Source
AI summary
A method for detecting malware includes dividing data to be scanned for malware into at least a first data segment and a second data segment, dividing a signature corresponding to an indication of malware into at least a first signature segment and a second signature segment, performing a relationship function on the first signature segment and the second signature segment yielding a first result, performing the relationship function on the first data segment and the second data segment yielding a second result, comparing the first result and the second result, and, based on the comparison, determining that the data includes information corresponding to the signature. The relationship function characterizes the relationship between at least two information sets.