Automated Fuzzy Hash Signature Generation for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection techniques are ineffective against evolving malware variants, as they rely on traditional hash-based signatures that fail to detect subtle differences, leading to false positives and false negatives.
Innovation Solution
An automated fuzzy hash signature generator is employed to efficiently generate signatures that minimize false positives and negatives by using fuzzy hashing schemes, such as ssdeep, to identify and mitigate new malware variants through progressive clustering and filtering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional hash-based signatures are used for malware detection, then detection speed is improved, but detection accuracy deteriorates due to inability to detect subtle differences in malware variants
Solution Approach 1:
The patent transforms the detection approach by changing the parameter used for comparison from exact hash values to fuzzy hash similarity scores. This allows the system to detect malware variants that have subtle modifications by measuring similarity rather than requiring exact matches, thereby improving detection accuracy while maintaining reasonable detection speed through efficient similarity algorithms.
Solution Approach 2:
The patent introduces dynamic thresholding where the similarity threshold for detecting malware variants is not fixed but can be adjusted based on the analysis results and confidence levels. This dynamic approach allows the system to adapt to different malware families and their variation patterns, improving overall detection accuracy across diverse malware types.
2Measurement precision
If fuzzy hashing schemes are used to detect malware variants, then detection accuracy is improved, but computational complexity increases
Solution Approach 1:
The patent segments the fuzzy hashing process into multiple stages: initial rapid filtering using lightweight similarity checks, followed by more computationally intensive analysis only for suspicious samples. This segmentation allows the system to achieve high detection accuracy while minimizing overall computational complexity by applying heavy processing only where necessary.
Solution Approach 2:
The patent implements a tiered analysis approach where not all samples undergo complete fuzzy hashing analysis. Instead, a preliminary filter identifies high-probability malware candidates that then receive full analysis, while low-probability samples are quickly dismissed. This partial action approach maintains high detection accuracy for critical cases while reducing average computational complexity.
3Reliability
If progressive clustering is applied to group malware variants, then false positives are reduced, but processing time increases
Solution Approach 1:
The patent implements periodic clustering where samples are grouped into clusters based on similarity, and analysis is performed periodically on cluster representatives rather than every individual sample. This approach reduces false positives by leveraging cluster-level patterns while significantly reducing processing time through the periodic rather than continuous analysis model.
Solution Approach 2:
The patent performs preliminary clustering and identification of cluster representatives before final detection analysis. By pre-grouping samples and identifying representative members of each malware family cluster, the system reduces false positives through pattern recognition at the cluster level while minimizing processing time by avoiding redundant analysis of similar variants.
Data Source
AI summary
Automated fuzzy hash based signature collection is disclosed. A set of candidate fuzzy hashes corresponding to a set of false negative samples is received. A false positive reduction analysis is performed on the received set of candidate fuzzy hashes to generate a reduced set of fuzzy hashes. At least a portion of the reduced set of fuzzy hashes is clustered into a fuzzy hash cluster. A signature for a family of malware is generated based at least in part on the fuzzy hash cluster.