Entropy-Based Malware Detection via Data Segmentation

Solution Overview

Problem

Current malware detection methods face challenges in identifying suspicious data due to high false positives and the ability of attackers to hide malware by altering its entropy, making it difficult to distinguish between encrypted/obfuscated data and structured data.

Innovation Solution

A method that calculates data entropy by dividing data blocks, applying Shannon Entropy calculations, and recombining entropy values to determine overall entropy, combined with metadata analysis to filter out suspicious data, using a threshold value to identify potentially malicious data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If entropy calculation is used to identify suspicious data, then malware detection capability is improved, but false positive rate increases due to inability to distinguish encrypted data from structured data

Engineering Contradiction:

Improvemalware detection capabilityVSAvoidfalse positive rate

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The patent divides a data block into multiple segments and calculates entropy for each segment individually. This segmentation allows the system to detect local high-entropy regions within an otherwise structured file, identifying packed or encrypted sections that would be missed by global entropy calculation alone. The segment entropy values are then combined to determine overall suspiciousness, reducing false positives while maintaining detection capability.

Inventive Principle:

Principle #1Segmentation

2Ease of operation

If global entropy measurement is applied to entire data blocks, then calculation simplicity is improved, but detection accuracy deteriorates when malware is embedded in structured data

Engineering Contradiction:

Improvecalculation simplicityVSAvoiddetection accuracy

Core Design Contradiction:

Ease of operationVSMeasurement precision

Solution Approach 1:

The patent divides a data block into multiple segments and calculates entropy for each segment individually. This segmentation allows the system to detect local high-entropy regions within an otherwise structured file, identifying packed or encrypted sections that would be missed by global entropy calculation alone. The segment entropy values are then combined to determine overall suspiciousness, reducing false positives while maintaining detection capability.

Inventive Principle:

Principle #1Segmentation

3Object-affected harmful factors

If attackers use packing techniques to obfuscate malware, then malware hiding capability is improved, but entropy-based detection becomes more effective

Engineering Contradiction:

Improvemalware hiding capabilityVSAvoidentropy-based detection effectiveness

Core Design Contradiction:

Object-affected harmful factorsVSReliability

Solution Approach 1:

The patent divides a data block into multiple segments and calculates entropy for each segment individually. This segmentation allows the system to detect local high-entropy regions within an otherwise structured file, identifying packed or encrypted sections that would be missed by global entropy calculation alone. The segment entropy values are then combined to determine overall suspiciousness, reducing false positives while maintaining detection capability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies different analysis approaches to different segments of the data block. By calculating entropy locally for each segment and comparing segment entropy to the overall block entropy, the system can identify regions with abnormal entropy characteristics that indicate packed or encrypted malware sections, while tolerating the structured nature of legitimate file portions.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS8069484B2System and method for determining data entropy to identify malware

Publication Date: 2011.11.29 MAGENTA SECURITY HOLDINGS LLC

AI summary

Systems and methods for performing malware detection for determining suspicious data based on data entropy are provided. The method includes acquiring a block of data, calculating an entropy value for the block of data, comparing the entropy value to a threshold value, and recording the block of data as suspicious when the entropy value exceeds the threshold value. An administrator may then investigate suspicious data.