File Matching via Function Relationship Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional file comparison systems are inefficient and resource-intensive, often unable to detect modified files that have evaded detection by minor changes, posing a challenge in identifying malicious files and maintaining computing device security.
Innovation Solution
A computer-implemented method that analyzes files to identify functions and relationships, creates representations by combining function sizes, and compares these representations with those of other files to determine matches, allowing for efficient detection of similar files, including malicious ones, through modules like analysis, creation, comparison, and determination modules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional file comparison systems analyze files in detail to identify malicious content, then detection accuracy is improved, but computing resource consumption increases significantly
Solution Approach 1:
The file analysis process is segmented into multiple stages: first extracting high-level features (file type, size, author), then selectively analyzing deeper structural features (function relationships, code patterns) only for suspicious files. This hierarchical segmentation allows the system to maintain detection accuracy while reducing overall computing resource consumption by avoiding exhaustive analysis of all files.
Solution Approach 2:
The system performs preliminary analysis by extracting and comparing high-level file features before conducting detailed malicious content analysis. By pre-identifying suspicious files through lightweight feature comparison (file metadata, basic structure), the system prepares a shortlist of candidates that require intensive analysis, thereby reducing total computing resource usage while maintaining detection accuracy.
2Use of energy by moving object
If traditional systems compare only identical files, then resource consumption is reduced, but the ability to detect modified malicious files is lost
Solution Approach 1:
The system changes the parameters of file comparison from exact byte-level matching to feature-based similarity matching. By extracting key features (function relationships, code patterns, structural characteristics) and comparing these abstracted parameters, the system can detect modified malicious files that retain the same functional behavior despite surface-level changes, maintaining detection capability while managing resource consumption through intelligent feature selection.
3Measurement precision
If detailed function analysis is performed on all files, then matching accuracy is improved, but processing speed decreases
Solution Approach 1:
The file processing pipeline is segmented into fast filtering stages and slow analysis stages. High-level feature extraction (file metadata, basic structure) is performed on all files quickly, then detailed function analysis is segmented to apply only to files flagged as suspicious. This segmentation maintains matching accuracy for critical files while preserving overall processing speed by avoiding exhaustive detailed analysis of every file.
Solution Approach 2:
The system applies partial detailed analysis to only the portion of files that are suspicious based on preliminary screening. Rather than performing excessive full-analysis on all files, the system conducts partial deep analysis (function relationships, code patterns) selectively on a subset of files that require it, thereby maintaining matching accuracy for relevant cases while preserving processing throughput.
Data Source
AI summary
The disclosed computer-implemented method for efficiently matching files may include (i) analyzing a file to identify a set of functions within the file and relationships between functions within the set of functions, (ii) creating a set of representations for the set of functions by, for each function, combining a representation of a size of the function with a representation of a size of each function identified, when analyzing the file, as having a relationship to the function, (iii) comparing the set of representations of the set of functions with a set of representations of an additional set of functions identified within an additional file, and (iv) determining, based on comparing the sets of representations, that the file matches the additional file. Various other methods, systems, and computer-readable media are also disclosed.