Entropy Profile Rules for Packed Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems struggle to identify malicious files that have been encoded or obfuscated using the same packing method, as these files often evade detection by relying on clear text string matching, leading to unauthorized access and network vulnerabilities.
Innovation Solution
A malware detection system uses entropy profiles to generate rules that analyze the randomness of data within files, allowing for the detection of malicious files without the need for unpacking, by comparing entropy values across slices of the file to identify patterns indicative of the same packing method.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If clear text string matching is used for malware detection, then detection simplicity is maintained, but detection accuracy deteriorates when files are encoded or obfuscated
Solution Approach 1:
The patent transforms the detection approach by changing from clear text string matching to entropy value analysis. By calculating entropy profiles across different slices of the file and comparing these statistical parameters, the system can detect malicious patterns even when the actual text content is encoded or obfuscated, thus resolving the contradiction between simplicity and accuracy
Solution Approach 2:
The patent replaces the mechanical string matching mechanism with a statistical entropy analysis mechanism. Instead of literally searching for specific text patterns, the system uses entropy calculations to identify characteristic distributions of encoded data, maintaining operational simplicity while dramatically improving detection accuracy against obfuscated malware
2Measurement precision
If malware files are unpacked for analysis, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The patent extracts the essential detection feature (entropy profile) directly from the encoded malware file without requiring full unpacking. By calculating entropy values on the packed file itself and comparing these extracted statistical characteristics against known malware profiles, the system achieves accurate detection while avoiding the time-consuming unpacking process
Solution Approach 2:
The patent performs preliminary entropy analysis on the packed file before unpacking occurs. By pre-calculating entropy profiles and creating detection rules from these profiles, the system can quickly identify malicious files in their encoded state, eliminating the need for time-consuming unpacking and analysis of the decompressed content
3Adaptability or versatility
If multiple detection rules are created for different malware variations, then detection coverage improves, but rule complexity and false positives increase
Solution Approach 1:
The patent creates a universal entropy-based detection rule that can identify multiple malware variations through a single unified approach. By comparing the entropy profile characteristics of different malware families and creating a generalized detection rule based on these statistical patterns, the system achieves broad detection coverage without requiring separate complex rules for each malware variant, thus reducing false positives and rule complexity
Data Source
AI summary
In some embodiments, a method receives a file. The file is packed using a packing method. An entropy profile is generated for the file. The entropy profile describes an entropy of data over positions in the file. The method generates a rule to detect the entropy profile of the file by analyzing entropy values from the entropy profile in slices in the file. The rule is output. The rule is usable to detect in other files that use the packing method based on analyzing entropy in slices of the other files.