Software Module Classification via Fuzzy Hash Fingerprints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems lack efficient methods for classifying and managing software modules, particularly malicious ones like malware, in computer networks, which poses a threat to client devices and enterprises through various infection vectors.
Innovation Solution
A method involving the extraction of code fragments from software modules, computation of fingerprints using fuzzy hash functions, and determination of similarity scores to classify modules as malicious or benign, with subsequent modification of access rights on client devices based on these classifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional security systems are used to detect and classify software modules, then security threats can be identified, but the systems lack efficiency and cannot effectively manage large volumes of software modules
Solution Approach 1:
The patent segments software modules into code fragments and generates fingerprints for each fragment independently. This segmentation allows parallel processing of multiple fragments, significantly improving classification efficiency without requiring complex monolithic analysis systems. Each code fragment can be analyzed separately and results aggregated, enabling scalable deployment.
Solution Approach 2:
The patent introduces fingerprints as an intermediary representation between the original code and the classification system. These fingerprints serve as compact, comparable descriptors that enable efficient similarity matching against known malware signatures, avoiding the need for complex direct code analysis while maintaining detection accuracy.
2Measurement precision
If comprehensive code analysis is performed on all software modules, then classification accuracy improves, but the processing time and computational resources increase significantly
Solution Approach 1:
The patent extracts key code fragments from software modules and generates fingerprints only for these representative fragments rather than analyzing the entire codebase. This extraction approach maintains classification accuracy by focusing on distinctive code patterns while dramatically reducing processing time and computational overhead.
Solution Approach 2:
The patent transforms code fragments into fingerprint representations, changing the parameter space from raw code bytes to condensed fingerprint values. This parameter transformation enables efficient comparison operations and reduces the dimensional complexity of the analysis, allowing rapid processing without sacrificing detection precision.
3Reliability
If fuzzy hash functions are applied to code fragments to generate fingerprints, then similarity detection between malware variants improves, but the computational overhead increases
Solution Approach 1:
The patent applies fuzzy hashing only to selected code fragments rather than the entire software module. This partial application provides sufficient detection reliability for identifying malware variants while keeping computational energy consumption manageable by focusing resources on the most informative code portions.
Data Source
AI summary
A method includes extracting one or more code fragments from a first software module and computing fingerprints of the code fragments extracted from the first software module. The method also includes determining a similarity score based on distances between the fingerprints of the code fragments extracted from the first software module and fingerprints of one or more code fragments extracted from at least a second software module, the second software module being classified as a given software module type, each of the fingerprints being computed by application of a fuzzy hash function to a given one of the code fragments. The method further includes classifying the first software module as the given software module type based on the similarity score and modifying access by a given client device to the first software module responsive to classifying the first software module as the given software module type.