File Similarity Vector for Obfuscated Malware Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional malware detection methods are time-consuming and ineffective in detecting obfuscated malware, particularly when analyzing executable files, which can impact system performance.

Innovation Solution

A system and method that generates a file similarity vector by analyzing function lengths in executable files, comparing them with known malware files, and using statistics such as the number, maximum, minimum, and average function lengths to efficiently detect malicious software.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If conventional malware detection methods analyze executable files in detail, then detection accuracy is improved, but system performance deteriorates due to time consumption

Engineering Contradiction:

Improvemalware detection accuracyVSAvoidsystem performance

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The patent extracts only the essential characteristics needed for malware detection - specifically function length statistics - from the complete executable file. By taking out only the relevant features (function lengths, counts, averages) rather than analyzing the entire file, the system achieves good detection accuracy while significantly reducing processing time and maintaining system performance.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent creates simplified copies of executable files in the form of statistical profiles containing function length information. These statistical copies serve as proxies for the actual files, enabling rapid comparison and detection without requiring full file analysis, thus resolving the contradiction between accuracy and performance.

Inventive Principle:

Principle #26Copying

2Loss of time

If disassembly database is used to reduce program analysis load, then analysis time is reduced, but effectiveness deteriorates in detecting obfuscated malware

Engineering Contradiction:

Improveanalysis timeVSAvoidobfuscated malware detection effectiveness

Core Design Contradiction:

Loss of timeVSReliability

Solution Approach 1:

The patent changes the parameters used for malware detection from traditional disassembly-based features to function length statistics. This parameter transformation makes the detection method insensitive to code obfuscation techniques that alter disassembly output, while still maintaining the ability to detect obfuscated malware through their characteristic function length patterns.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent replaces the mechanical disassembly process with a statistical analysis approach. Instead of mechanically dissecting and comparing code structures through disassembly, the system uses statistical properties of function lengths, which remain consistent even when code is obfuscated, thereby maintaining detection effectiveness while reducing analysis time.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS10607010B2System and method using function length statistics to determine file similarity

Publication Date: 2020.03.31 GEN DIGITAL INC

AI summary

A file similarity vector for an executable file or executable object can be determined using function lengths of functions in the executable file or data object. The executable file or data object can be scanned, and lengths of functions can be determined. Various statistics such as number of functions, maximum function length, minimum function length, and average function length can be used to create a file similarity vector. The file similarity vector can be used to compare files.