Functional Hashing Algorithm for File Correlation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Traditional file hashing algorithms are effective for tracking changes in files but fail to efficiently identify and group similar files together, as they are deterministic and do not account for functional similarities between files with different content.

Innovation Solution

A functional hashing algorithm that generates multiple hashes for each file based on its functional features, such as file format-specific header information, layouts, and code relationships, allowing for different precision levels of functional similarity, from 25% to 100% in 25% increments, to group files with similar functionality together.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional file hashing algorithms are used to track file changes, then file integrity can be ensured, but similar files with different content cannot be identified or grouped together

Engineering Contradiction:
Improvefile integrity verificationVSAvoidability to identify and group similar files
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent segments a file into multiple portions (e.g., header, metadata, content sections) and generates separate hash values for each portion. This segmentation allows the system to analyze functional components independently, enabling identification of files with similar functionality even when their complete content differs. The segmented approach transforms a single deterministic hash into multiple functional indicators that can be compared across different files.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent changes the parameters of file analysis by generating multiple hash values at different precision levels (e.g., 25%, 50%, 75%, 100% similarity thresholds) rather than using a single hash. This parameter transformation allows the same hashing mechanism to serve dual purposes: ensuring file integrity at 100% precision and identifying similar files at lower precision levels, thereby resolving the contradiction between reliability and adaptability.

Inventive Principle:
Principle #35Parameter changes

2Adaptability or versatility

If multiple hash levels are generated for each file portion, then functional similarity can be identified at different precision levels, but computational complexity increases

Engineering Contradiction:
Improvemulti-level functional similarity detectionVSAvoidhash generation complexity
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent performs preliminary segmentation of files into standardized portions with predefined functional characteristics before hash generation. This preliminary organization allows subsequent hash computations to operate on structured, predictable data segments rather than raw file contents, reducing the overall computational complexity despite generating multiple hash levels. The preprocessing step creates a framework that simplifies multi-level analysis.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent implements a tiered hash generation approach where not all file portions are hashed at all precision levels. Instead, critical portions (e.g., headers, metadata) are hashed at higher precision levels while less critical portions are hashed at lower precision levels. This partial action strategy reduces computational complexity while still achieving effective functional similarity detection across multiple precision levels.

Inventive Principle:
Principle #16Partial or excessive action

3Measurement precision

If files are analyzed in detail to determine functional similarity, then accurate grouping can be achieved, but processing time increases

Engineering Contradiction:
Improvefunctional similarity accuracyVSAvoidfile analysis time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The patent divides file analysis into multiple independent portions that can be processed in parallel. By segmenting the analysis task, the system can compute hash values for different file portions simultaneously rather than sequentially, maintaining high measurement precision for functional similarity while significantly reducing total processing time through parallel computation.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent implements periodic action by generating hash values at predetermined precision intervals (e.g., 25%, 50%, 75%, 100%) rather than continuously analyzing all possible similarity levels. This periodic approach maintains measurement precision at critical thresholds while reducing processing time by avoiding redundant computations between intervals.

Inventive Principle:
Principle #19Periodic action

Data Source

PatentEP3227797B1System and method for fast and scalable functional file correlation
Publication Date: 2021.01.27 REVERSINGLABS INT
  • EP3227797B1 patent drawingFigure 1
  • EP3227797B1 patent drawingFigure 2
  • EP3227797B1 patent drawingFigure 3

AI summary

A method, computer program product, and computer system for obtaining, by a computing device, a file, wherein the file includes a plurality of portions. A first hash of a first portion of the plurality of portions may be generated. The first portion may be combined with a second portion of the plurality of portions. A second hash of the first portion with the second portion of the plurality of portions may be generated, wherein the first hash may be indicative of a first level of functional similarity between a function of the file and a function of a second file, wherein the second hash may be indicative of a second level of functional similarity with the function of the file and the function of the second file.