File Fragment Detection for Obfuscated Malware Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus technologies struggle to effectively detect sophisticated malicious files, particularly those used in targeted attacks, due to obfuscation techniques employed by cybercriminals, which complicate analysis and classification.
Innovation Solution
A method and system for detecting malicious files based on file fragments, involving extraction and categorization of data fragments using a database of known fragments, with thresholds and rules to determine file categorization as trusted, malicious, or untrusted, without requiring decompilation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If complex analysis techniques are used to detect obfuscated malicious files, then detection accuracy is improved, but computational complexity and processing time increase
Solution Approach 1:
The patent divides the malicious file into multiple data fragments and analyzes them separately. Each fragment is extracted and categorized independently, allowing the system to detect malicious patterns without needing to fully decode or analyze the entire obfuscated file, thus reducing computational complexity while maintaining detection accuracy
Solution Approach 2:
The patent extracts specific data fragments from the file that contain malicious indicators. By taking out and analyzing only the relevant fragments rather than the entire file, the system achieves accurate detection with reduced computational resources and processing time
2Reliability
If traditional antivirus scanning is performed on all files, then security coverage is improved, but processing speed decreases
Solution Approach 1:
The patent applies partial action by analyzing only specific data fragments rather than performing complete antivirus scanning on entire files. This selective approach maintains security coverage for malicious detection while significantly improving processing speed by avoiding redundant analysis of benign file portions
3Difficulty of detecting and measuring
If decompilation is performed to analyze malicious software, then analysis depth is improved, but processing time and computational resources increase
Solution Approach 1:
The patent extracts and analyzes specific data fragments directly from the file without requiring full decompilation. This approach achieves sufficient analysis depth for detecting malicious patterns while avoiding the time-consuming process of complete decompilation and reconstruction of the software
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are systems and methods for detecting malicious files based on file fragments. In one example, an exemplary method comprises, extracting data fragments from a file, for each extracted data fragment, determining a category selected from a list of categories that includes at least: trusted, malicious, and untrusted, when a number of data fragments categorized as being malicious is below a predetermined threshold, avoiding categorization of the file as malicious, and when a number of data fragments categorized as being malicious reaches or exceeds the predetermined threshold, determining whether at least one malicious file detection rule having criteria for detecting a malicious file is found, when at least one malicious file detection rule whose criteria is met is found, categorizing the file as a malicious file, and when no malicious file detection rule whose criteria is met is found, avoiding categorization of the file as a malicious file.