File Fragment Detection for Obfuscated Malware Classification

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing antivirus technologies struggle to effectively detect sophisticated malicious files, particularly those used in targeted attacks, due to obfuscation techniques employed by cybercriminals, which complicate analysis and classification.

Innovation Solution

A method and system for detecting malicious files based on file fragments, involving extraction and categorization of data fragments using a database of known fragments, with thresholds and rules to determine file categorization as trusted, malicious, or untrusted, without requiring decompilation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If complex analysis techniques are used to detect obfuscated malicious files, then detection accuracy is improved, but computational complexity and processing time increase

Engineering Contradiction:
Improvedetection accuracyVSAvoidcomputational complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent divides the malicious file into multiple data fragments and analyzes them separately. Each fragment is extracted and categorized independently, allowing the system to detect malicious patterns without needing to fully decode or analyze the entire obfuscated file, thus reducing computational complexity while maintaining detection accuracy

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent extracts specific data fragments from the file that contain malicious indicators. By taking out and analyzing only the relevant fragments rather than the entire file, the system achieves accurate detection with reduced computational resources and processing time

Inventive Principle:
Principle #2Taking out (Extraction)

2Reliability

If traditional antivirus scanning is performed on all files, then security coverage is improved, but processing speed decreases

Engineering Contradiction:
Improvesecurity coverageVSAvoidprocessing speed
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The patent applies partial action by analyzing only specific data fragments rather than performing complete antivirus scanning on entire files. This selective approach maintains security coverage for malicious detection while significantly improving processing speed by avoiding redundant analysis of benign file portions

Inventive Principle:
Principle #16Partial or excessive action

3Difficulty of detecting and measuring

If decompilation is performed to analyze malicious software, then analysis depth is improved, but processing time and computational resources increase

Engineering Contradiction:
Improveanalysis depthVSAvoidprocessing time
Core Design Contradiction:
Difficulty of detecting and measuringVSLoss of time

Solution Approach 1:

The patent extracts and analyzes specific data fragments directly from the file without requiring full decompilation. This approach achieves sufficient analysis depth for detecting malicious patterns while avoiding the time-consuming process of complete decompilation and reconstruction of the software

Inventive Principle:
Principle #2Taking out (Extraction)

Data Source

PatentEP3767510B1System and method of detecting malicious files based on file fragments
Publication Date: 2025.11.19 AO KASPERSKY LAB
  • EP3767510B1 patent drawingFigure 1
  • EP3767510B1 patent drawingFigure 2
  • EP3767510B1 patent drawingFigure 3

AI summary

Disclosed herein are systems and methods for detecting malicious files based on file fragments. In one example, an exemplary method comprises, extracting data fragments from a file, for each extracted data fragment, determining a category selected from a list of categories that includes at least: trusted, malicious, and untrusted, when a number of data fragments categorized as being malicious is below a predetermined threshold, avoiding categorization of the file as malicious, and when a number of data fragments categorized as being malicious reaches or exceeds the predetermined threshold, determining whether at least one malicious file detection rule having criteria for detecting a malicious file is found, when at least one malicious file detection rule whose criteria is met is found, categorizing the file as a malicious file, and when no malicious file detection rule whose criteria is met is found, avoiding categorization of the file as a malicious file.