Fuzzy Hash Digests for Malware Variant Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The rapid increase in mutated and new malicious executable files poses a challenge for effective detection using traditional antivirus techniques, as existing methods struggle to keep pace with the multitude of malware variants.
Innovation Solution
A cybersecurity server processes executable files by extracting and sorting metadata strings, merging them into data streams, and calculating a digest using a fuzzy hashing algorithm to determine similarity with known malware patterns, facilitating detection and clustering of malware families.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus techniques using malware signatures are used, then detection of known malware is achieved, but detection of mutated and new malicious executable files fails
Solution Approach 1:
The patent changes the detection parameter from exact malware signatures to fuzzy hash digests that measure similarity. Instead of requiring exact matches, the system calculates digests and compares similarity scores, allowing detection of mutated malware that retains characteristic patterns while having modified code.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a fuzzy hashing and similarity measurement system. This substitution enables probabilistic detection based on digest comparison rather than deterministic exact matching, improving adaptability to malware variants.
2Adaptability or versatility
If the number of malware signature patterns is increased to detect more variants, then detection coverage improves, but system complexity and processing time increase
Solution Approach 1:
The patent extracts essential characteristics of malware into compact digest representations. Instead of storing and processing numerous complex signature patterns, the system extracts key features into digest form, simplifying the detection mechanism while maintaining broad coverage of malware variants.
Solution Approach 2:
The fuzzy hash digest serves multiple functions: it represents malware for detection, enables similarity measurement, and works across different malware variants. This universal approach replaces the need for multiple specialized signatures, reducing system complexity while improving versatility.
3Measurement precision
If traditional hashing algorithms are used for file digests, then exact file identification is achieved, but detection of similar malware variants fails
Solution Approach 1:
The patent changes from traditional exact-matching hashing to fuzzy hashing that measures similarity. The digest calculation and comparison process is modified to allow for variations, transforming the parameter from binary match/no-match to a similarity score that enables detection of malware families and variants.
Data Source
AI summary
A cybersecurity server receives an executable file that has bytecode and metadata of the bytecode. Strings are extracted from the metadata, sorted, and merged into data streams. The data streams are merged to form a combined data stream. A digest of the combined data stream is calculated using a fuzzy hashing algorithm. The similarity of the digest to another digest is determined to detect whether or not the executable file is malware or a member of a malware family.