Fuzzy Hash Algorithm for Malware Variant Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods are inefficient in identifying variations of executable files in memory (RAM) and malware protected by packers or encryptors, as they struggle to detect altered executable portions and variants at runtime.
Innovation Solution
A digital DNA sequencing engine employing a fuzzy hash algorithm scans data objects, generates a digital DNA sequence, and compares it with reference values to detect and classify malware, including variants and protected forms, by analyzing meta-tags and hashing data streams to identify similarities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware detection methods are used, then detection of exact malware copies is achieved, but detection of malware variants and protected executables fails
Solution Approach 1:
The patent transforms the detection approach by changing from exact byte-matching parameters to similarity-based parameters. The fuzzy hash algorithm computes similarity scores that allow detection of malware variants with modified bytes, achieving both reliability for exact matches and adaptability for variants.
Solution Approach 2:
The patent segments the executable file into multiple blocks and computes fuzzy hashes for each block independently. This segmentation allows the system to detect malware even when certain blocks are modified or obfuscated, improving detection of protected and variant malware while maintaining detection of complete malware copies.
2Measurement precision
If exact matching algorithms are used, then false positives are minimized, but detection of altered executables in memory is impossible
Solution Approach 1:
The patent changes the measurement parameter from exact byte equality to fuzzy similarity scoring. The fuzzy hash algorithm produces similarity percentages that allow detection of altered executables while maintaining precision through configurable similarity thresholds that minimize false positives.
3Reliability
If runtime execution analysis is performed, then detection of malware behavior is achieved, but performance overhead and detection time increase significantly
Solution Approach 1:
The patent performs preliminary fuzzy hash computation on executable files before runtime execution. By pre-computing fuzzy hashes and storing them for comparison, the system enables rapid detection during runtime without significant performance overhead, achieving reliable malware behavior detection while maintaining system productivity.
Data Source
AI summary
An embodiment of the invention provides a method for and an apparatus for classifying a data object by use of a fuzzy hash. The method and apparatus can perform steps including: aligning a window in a target data object; reading content within the window; hashing the content within the window in order to calculate a hash value; splicing a spliced portion from the hashed value; and storing the spliced portion as part of a fuzzy hash.