Entropy Analysis for Proactive Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malware systems rely on reactive approaches, identifying malware after it has caused damage, and struggle to predictively or proactively determine if a computer file of unknown content is related to a known file or category, which is also a challenge in information security beyond malware detection.
Innovation Solution
A method and system that perform entropy analysis on known and unknown data sets to determine similarity, using an entropy analysis engine and classification engine to identify if an unknown data set is substantially related to a known data set by comparing entropy results within a predetermined threshold.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection methods are used to identify malware, then detection capability is improved for known malware, but the system cannot proactively identify unknown or related files
Solution Approach 1:
The patent changes the detection parameter from fixed malware signatures to statistical entropy values. By analyzing the entropy distribution of file data and comparing it against known patterns, the system can identify both known malware and unknown related files without requiring explicit signatures, thus resolving the contradiction between reliable detection and adaptability to unknown files
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a statistical analysis system. Instead of mechanically comparing file contents against a database of known signatures, the system uses statistical entropy calculations to detect patterns and relationships, enabling proactive identification of unknown malware variants and related files
2Loss of time
If reactive malware detection approaches are used, then identification of known malware is achieved, but predictive or proactive identification of related files is not possible
Solution Approach 1:
The patent performs preliminary entropy analysis on unknown files before they can cause damage. By proactively analyzing the statistical characteristics of file data and comparing it against entropy patterns of known malware categories, the system can predictively identify potential threats in advance, eliminating the need for reactive response and improving both timing and reliability
3Object-affected harmful factors
If traditional anti-malware systems are used, then protection against known malware is provided, but difficulty in identifying relationships between unknown files and known files persists
Solution Approach 1:
The patent introduces entropy analysis as an intermediary mechanism between the unknown file and the known malware database. Instead of directly comparing file contents (which is difficult for large files like source code), the system calculates entropy statistics as an intermediate representation and compares these statistics, making the detection of relationships between unknown and known files feasible and efficient
Data Source
AI summary
In accordance with one embodiment of the present disclosure, a method for determining the similarity between a first data set and a second data set is provided. The method includes performing an entropy analysis on the first and second data sets to produce a first entropy result, wherein the first data set comprises data representative of a first one or more computer files of known content and the second data set comprises data representative of a one or more computer files of unknown content; analyzing the first entropy result; and if the first entropy result is within a predetermined threshold, identifying the second data set as substantially related to the first data set.