File Infection Detection via Characteristic Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods, such as signature-based and behavioral analysis, are inadequate in identifying infected files, especially polymorphic malware, due to resource intensity and high false positive/negative rates, and limitations in detecting unknown or less-popular legitimate files.
Innovation Solution
A system comprising a scanning module and an analysis module that determines if an unchecked file is related to and functionally equivalent to a clean file by calculating a weighted sum of differences in characteristics, excluding variant portions, to identify if the unchecked file is infected by determining a distance below a predetermined threshold.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavioral analysis is used to detect malware, then detection capability is improved, but resource consumption increases and false positives/negatives increase
Solution Approach 1:
The patent segments the file into multiple sections and extracts specific characteristics from each section, comparing only relevant features rather than performing complete behavioral analysis. This reduces computational resources while maintaining detection effectiveness by focusing on key discriminative features.
Solution Approach 2:
The patent transforms the detection approach by changing parameters from comprehensive behavioral monitoring to comparing specific file characteristics (such as section names, entry points, and code patterns). This parameter transformation reduces resource consumption while maintaining detection reliability through targeted feature comparison.
2Reliability
If behavioral analysis is used to detect malware, then detection capability is improved, but false positives and false negatives increase
Solution Approach 1:
The patent applies local quality by examining specific sections and characteristics of files rather than performing uniform analysis across entire files. By focusing on locally distinctive features (such as specific code sections, headers, and metadata), the system achieves more precise differentiation between legitimate and malicious files, reducing false positives and negatives.
Solution Approach 2:
Instead of analyzing files for malicious behavior patterns (which causes false positives), the patent inverts the approach by comparing files against known legitimate file characteristics. This inversion reduces false positives by establishing what normal files should contain, while still detecting malware through absence of expected characteristics.
3Reliability
If white-listing technology is used, then false negatives are reduced, but unknown legitimate files are prevented from executing
Solution Approach 1:
The patent implements a dynamic detection system that adapts to both known and unknown files. Rather than using a static white-list, the system dynamically compares file characteristics against learned patterns from legitimate files, allowing it to accommodate new legitimate files while maintaining protection against malware. This dynamic approach resolves the contradiction between reducing false negatives and maintaining adaptability.
4Reliability
If signature-based detection is used, then known malware is detected, but unknown and polymorphic malware cannot be detected
Solution Approach 1:
The patent creates a universal detection mechanism that functions for both known and unknown malware types. By extracting and comparing fundamental file characteristics rather than relying on specific malware signatures, the system achieves multi-functionality: it detects known malware through characteristic pattern recognition while also detecting unknown and polymorphic malware through anomaly detection based on deviations from legitimate file patterns.
Data Source
AI summary
A computer-implemented method for detecting infected files may include identifying a set of known-clean files. The method may also include identifying a set of characteristics of an unchecked file. The method may further include determine that the unchecked file is related to a clean file in the set of known-clean files. The determination may be based on the set of characteristics of the unchecked file. The method may additionally include determining whether the unchecked file is functionally equivalent to the clean file. This determination may be based on the set of characteristics of the unchecked file. Various other methods, systems, and computer-readable media are also disclosed.