Flexible Malware Detection via Dual Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods, such as signature-based detection and heuristic analysis, are ineffective against polymorph packagers that generate multiple variants of malicious files with different structures but similar functionality, leading to high false positives and inefficiencies in network infrastructure usage.
Innovation Solution
A system that identifies and generates hashes for both fixed and variable attributes of files using sensitive and insensitive hashing algorithms, creating an aggregate representation for similarity comparison, which reduces false positives and improves detection efficiency by clustering similar files, including malicious ones.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection is used to detect malicious files, then detection accuracy for known malware is improved, but false positives increase and detection efficiency decreases when polymorph packagers generate multiple variants with different structures
Solution Approach 1:
The patent segments file attributes into two categories: fixed attributes (e.g., file type, compiler information, API calls) that remain consistent across polymorph variants, and variable attributes (e.g., file size, section positions) that change between variants. By creating separate hash representations for each category, the system maintains detection accuracy for fixed attributes while tolerating variations in variable attributes, thereby reducing false positives for polymorph malware families.
2Measurement precision
If metadata analysis is performed on large sets of files to improve malware detection quality, then detection accuracy is improved, but network infrastructure load increases significantly
Solution Approach 1:
The patent extracts only the essential fixed attributes from files that are critical for malware detection (e.g., file type, compiler info, API calls) and creates hash representations from these extracted features. This selective extraction approach maintains high detection accuracy by focusing on the most discriminative features while significantly reducing the amount of data that needs to be transmitted over the network, thereby reducing infrastructure load.
Solution Approach 2:
The patent transforms file metadata into hash representations, changing the parameter form from detailed metadata to compact hash values. This parameter transformation maintains the essential detection information while dramatically reducing data size, allowing accurate malware detection with minimal network transmission requirements.
3Adaptability or versatility
If unique signatures are created for each polymorph variant to improve detection coverage, then detection completeness is improved, but device complexity and maintenance burden increase
Solution Approach 1:
The patent creates a universal detection mechanism that works across all polymorph variants within a malware family. By focusing on fixed attributes that remain consistent across variants (e.g., API calls, compiler information, file type), a single hash representation can detect entire families of polymorph malware rather than requiring individual signatures for each variant, thereby reducing signature management complexity while maintaining comprehensive detection coverage.
Data Source
AI summary
System and method for analyzing a target object for similarity to classes of reference objects. A first and a second set of attributes of the target object is identified composed respectively of attributes having values that are common, and variable, among a class of similar objects. A first hash is computed representing the first set of attributes according to a first hashing algorithm that is sensitive to variations in the first set of attributes among the class of similar objects. A second hash representing the second set of attributes is computed according to a second hashing algorithm that is insensitive to variations in the second set of attributes among the class of similar objects. An aggregate representation of the target object that is based on the first hash and the second hash is generated.