Malware Detection via Fuzzy Checksum Trees
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods, such as signature and checksum-based approaches, are ineffective against new or 'zero-day' malware variants that evade detection by re-packing or re-compiling, leading to increased administrative challenges in protecting computers and networks from malicious software.
Innovation Solution
A communication system utilizing fuzzy rolling checksums in a checksum tree to detect malware, which generates classification intelligence through machine-learning training, allowing for proactive protection against new malware variants by identifying relationships between files and performing accurate, scalable detection across multiple systems with low false-positive rates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature and checksum-based detection methods are used, then detection accuracy for known malware is improved, but detection effectiveness against new or zero-day malware variants deteriorates
Solution Approach 1:
The system pre-calculates and stores checksums for multiple possible malware variants in a checksum tree during an offline training phase. This preliminary action enables the system to detect new malware variants without requiring real-time analysis, as the detection signatures are prepared in advance and can be quickly applied when malware is encountered.
Solution Approach 2:
The checksum tree is dynamically generated through machine learning training on malware samples and updated as new malware variants are discovered. This dynamic adaptation allows the system to evolve its detection capabilities, maintaining high accuracy against both known and emerging threats by continuously incorporating new malware patterns into the checksum tree.
2Reliability
If traditional malware detection systems are implemented, then protection against known malware is improved, but administrative challenges and complexity increase
Solution Approach 1:
The system automatically generates checksum trees through machine learning training without requiring manual intervention for each malware variant. The automated process of creating and updating detection signatures reduces administrative burden while maintaining reliable protection, as the system serves itself by continuously adapting to new threats without extensive human configuration.
3Reliability
If comprehensive malware detection is performed across all files, then detection coverage is improved, but processing time and system performance deteriorate
Solution Approach 1:
The system segments the malware detection problem by organizing checksums into a tree structure with multiple levels. This segmentation allows the detection process to navigate from general to specific malware patterns efficiently, checking only relevant portions of the checksum tree based on file characteristics, thereby maintaining comprehensive coverage while reducing processing time through selective analysis.
Data Source
AI summary
Systems and methods are provided in example embodiments for mitigating malicious calls. The system can be configured to determine a series of checksums for a file, compare the series of checksums to a checksum tree, where the checksum tree includes a plurality of nodes that each include a fuzzy checksum of known malware, and assign one or more classifications to the file, where each of the one or more classifications is based on each node of the checksum tree that matches a checksum in the series of checksums and includes whether the file includes malware or benign checksums.