File Detection via Weak Structure Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus technologies struggle to detect unknown malicious codes and new varieties of malicious files due to the time-consuming process of creating signatures and the increasing complexity of file formats, as they rely on exact samples and signatures for detection.
Innovation Solution
The method involves examining incoming files for weak file structures and suspicious loading patterns, identifying nonconforming file structures that are still loadable by file loaders, and creating detection rules to differentiate between normal, damaged, and abnormal files based on these criteria, without requiring specific malicious code samples or signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If antivirus relies on signatures for detecting malicious files, then detection accuracy for known threats is improved, but detection capability for unknown malicious codes deteriorates
Solution Approach 1:
The patent performs preliminary analysis of file structures and loading behaviors before malicious activity occurs. By examining file format conformity, structure validity, and expected loading patterns in advance, the system establishes a baseline of normal behavior that enables detection of unknown threats without requiring pre-existing signatures.
Solution Approach 2:
The patent transitions from static signature-based detection to dynamic behavior-based detection. Instead of relying on fixed malicious code patterns, the system monitors how files actually behave during loading and execution, adapting detection criteria based on observed deviations from expected file format specifications and loading behaviors.
2Adaptability or versatility
If antivirus creates complete set of signatures for all malicious file varieties, then detection coverage is improved, but time and resource requirements worsen
Solution Approach 1:
The patent enables the detection system to automatically analyze file structures and identify anomalies without requiring manual signature creation. The system serves itself by autonomously examining incoming files, comparing them against file format specifications, and detecting deviations that indicate malicious content, eliminating the time-consuming manual signature development process.
Solution Approach 2:
The patent shifts detection parameters from fixed signature patterns to dynamic structural and behavioral criteria. By changing the detection approach from matching known malicious patterns to identifying deviations from expected file format specifications and loading behaviors, the system achieves broad detection coverage without requiring exhaustive signature sets.
3Measurement precision
If antivirus examines file content in detail for signature matching, then detection precision is improved, but processing speed deteriorates
Solution Approach 1:
The patent divides file examination into distinct segments: first examining file structure and format conformity, then analyzing loading behaviors, and finally detecting deviations from expected patterns. This segmented approach allows the system to process files efficiently by focusing on critical structural elements and behavioral patterns rather than examining every byte of content in detail.
Solution Approach 2:
The patent performs partial analysis by examining only the most critical aspects of file structure and loading behavior that indicate malicious content. Rather than analyzing complete file contents, the system focuses on key structural elements and behavioral patterns, achieving sufficient detection precision with reduced processing overhead.
Data Source
AI summary
Incoming files are examined to detect abnormal files. The incoming files may be examined for a weak file structure, such as a weak file format structure or a weak file data structure, to detect abnormal files. A weak file structure includes file structures that do not conform to the file format of the file yet still loadable by a file loader of the file format. The incoming files may also be examined for suspicious loading in memory to detect abnormal files.