File Signature Generation for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus software relies on pattern recognition and signature generation, which creates a vulnerability window until new malware is identified and signatures are updated, allowing unknown malware to go undetected for several hours to weeks, and is ineffective against user-modifiable files that can be modified to evade detection.
Innovation Solution
A system that generates file signatures based on more permanent portions of user-modifiable files, filtering out superficial data areas, and uses a white listing approach to trust known malware-free files, allowing them to pass through security measures while distrusting others, thereby closing the vulnerability window.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If antivirus software uses signature recognition to detect malware, then known malware can be identified and blocked, but new unknown malware cannot be detected during the vulnerability window
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing hash values of permanent portions of user-modifiable files (like Office documents) before they potentially contain malware. When a file is saved, the system has already prepared hash values of its permanent portions, enabling immediate comparison and detection without waiting for traditional signature updates, thus closing the vulnerability window
2Reliability
If antivirus software generates file signatures based on entire files, then detection can be comprehensive, but user-modifiable files can be easily modified to evade detection through cosmetic changes
Solution Approach 1:
The patent applies segmentation by dividing files into permanent portions (headers, metadata, structural elements) and non-permanent portions (user-editable content). The system generates hash values only from permanent portions, which remain unchanged by cosmetic modifications. This segmentation allows reliable detection of malware in permanent sections while ignoring benign changes in user-modifiable areas, preventing evasion through cosmetic changes
3Measurement precision
If antivirus software scans entire files for malware, then detection can be thorough, but processing time and computational resources are significantly consumed
Solution Approach 1:
The patent applies the extraction principle by removing non-essential portions of files from the signature generation process. Instead of hashing entire files, the system extracts and hashes only the permanent portions that are critical for file integrity and likely to contain malware. This extraction maintains detection thoroughness for critical sections while dramatically reducing processing time and computational overhead
Data Source
AI summary
A system and method for efficiently determining that a received file is not malware is presented. In operation, when a file is received at a computing device, an evaluation is made as to whether the file includes user-modifiable, or superficial, data areas, i.e., areas of the file that by their nature do not typically carry or embed malware. If the file includes superficial data areas, those superficial data areas are filtered out and a file signature is generated based on the remaining portions of the received file. The file can then be compared to a list of know malware to determine if the file is malware. Alternatively, the file can be compared to a list of known, trusted files to determine whether the file is trustworthy.