File Clustering for Zero-Day Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security software struggles to detect targeted attacks, especially those using zero-day exploits and advanced persistent threats, as they often resemble legitimate behaviors, leading to delayed detection and potential data loss.
Innovation Solution
The method employs file clustering to identify unknown files by determining their probability of being malicious based on co-occurrence with known files, using a bipartite graph to propagate classifications and leverage file reputation databases, thereby classifying unknown files as safe or malicious with high certainty.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security software uses malware signatures to detect targeted attacks, then known malware can be identified, but zero-day exploits and advanced persistent threats remain undetected
Solution Approach 1:
The system performs preliminary classification of files by analyzing their co-occurrence patterns with known malware files before actual infection occurs. By pre-establishing clusters of files that frequently appear together on infected devices, the system can identify unknown malware variants based on their association with known malicious files, enabling detection of zero-day exploits before they are discovered by traditional security software.
Solution Approach 2:
The patent introduces an intermediary approach by using file co-occurrence data as a mediator between known malware and unknown files. Instead of directly analyzing malware characteristics or relying on signatures, the system uses the pattern of file co-occurrence on infected devices as an intermediary indicator to infer the malicious nature of unknown files, thereby detecting advanced persistent threats that evade traditional detection methods.
2Reliability
If security software uses behavior-based heuristics to detect targeted attacks, then some unknown malware can be detected, but slow-moving attacks resembling legitimate behavior are missed
Solution Approach 1:
The system segments the detection problem by separating file classification from behavior analysis. Instead of trying to distinguish between malicious and legitimate behaviors (which is difficult for slow-moving attacks), the system segments the approach into two parts: (1) identifying files that co-occur with known malware on infected devices, and (2) classifying unknown files based on their co-occurrence patterns. This segmentation allows detection of advanced persistent threats without being confused by their legitimate-like behavior.
Solution Approach 2:
The patent applies copying by creating a virtual model of file co-occurrence patterns from known malware infections. By copying and analyzing the pattern of which files appear together on infected devices, the system can infer the nature of unknown files without directly observing their behavior. This copying approach enables detection of slow-moving attacks by relying on the statistical patterns of co-occurrence rather than real-time behavior analysis.
3Loss of time
If traditional security software waits for malware detection to identify threats, then response time is extended, but early detection before data loss is compromised
Solution Approach 1:
The system performs preliminary classification of files by analyzing their co-occurrence patterns with known malware files before actual infection occurs. By pre-establishing clusters of files that frequently appear together on infected devices, the system can identify unknown malware variants based on their association with known malicious files, enabling detection of zero-day exploits before they are discovered by traditional security software.
Solution Approach 2:
The patent implements feedback by continuously monitoring file co-occurrence patterns on devices and using this information to update classifications. When a file is detected that co-occurs with known malware, the system provides feedback by classifying the unknown file based on its co-occurrence pattern, thereby enabling early detection and preventing data loss before traditional detection methods would activate.
Data Source
AI summary
The disclosed computer-implemented method for detecting malware using file clustering may include (1) identifying a file with an unknown reputation, (2) identifying at least one file with a known reputation that co-occurs with the unknown file, (3) identifying a malware classification assigned to the known file, (4) determining a probability that the unknown file is of the same classification as the known file, and (5) assigning, based on the probability that the unknown file is of the same classification as the known file, the classification of the known file to the unknown file. Various other methods, systems, and computer-readable media are also disclosed.