Fuzzy Whitelisting Anti-Malware via Code Block Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods face challenges in efficiently maintaining and updating whitelist databases, particularly in handling variations in legitimate software due to differences introduced by compilers and polymorphisms, which can lead to false positives and inefficiencies in whitelisting.
Innovation Solution
A method involving client-server collaboration where target hashes representing distinct code blocks of a target object are sent to a server for comparison with reference hashes from whitelisted objects, determining a similarity score to label the object as non-malicious if the score exceeds a threshold, allowing for flexible whitelisting and efficient database management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional content-based malware detection methods are used, then known malware signatures can be detected, but polymorphic malware with modified signatures cannot be detected and false positives occur due to benign software variations
Solution Approach 1:
The patent segments the target object into multiple distinct code blocks, each representing a sequence of processor instructions. Hash values are generated for each code block separately, creating a distributed fingerprinting system that can tolerate variations in non-critical segments while maintaining detection of malicious patterns across critical segments.
Solution Approach 2:
The patent changes the parameter from exact hash matching to similarity score-based matching. Instead of requiring identical hash values, the system calculates a similarity score based on the count of common hashes between target and reference objects, allowing for benign variations while maintaining detection of malicious software.
2Measurement precision
If strict hash matching is used for whitelisting, then precise malware identification is achieved, but benign software variations cause false positives
Solution Approach 1:
The patent transforms the binary match/no-match parameter into a continuous similarity score parameter. This allows the system to account for benign variations by establishing a threshold that distinguishes between acceptable variations and genuine malware, improving both precision and reliability.
Solution Approach 2:
By segmenting the software into code blocks and generating individual hashes for each segment, the system can tolerate variations in non-critical segments. The similarity score aggregates matches across all segments, allowing benign variations in some segments while maintaining overall identification accuracy.
3Reliability
If complete target objects are scanned and compared on the server, then comprehensive malware detection is achieved, but network traffic increases and processing efficiency decreases
Solution Approach 1:
The patent extracts only the essential identifying features (hash values of code blocks) from the complete target object and transmits these to the server for comparison. This extraction reduces network traffic from megabytes to kilobytes while maintaining the ability to perform comprehensive malware detection through similarity scoring.
4Reliability
If frequent whitelist database updates are performed, then current malware protection is maintained, but system performance and database consistency become problematic
Solution Approach 1:
The patent extracts and transmits only the necessary hash comparison data to the server, enabling the server to perform updates and similarity calculations centrally. This reduces client-side complexity and enables more frequent, efficient database updates without compromising system performance.
Data Source
AI summary
In some embodiments, an anti-malware system accounts for benign differences between non- malicious data objects, such as differences introduced by compilers and other polymorphisms. A target object is separated into a multitude of code blocks, and a hash is calculated for each code block. The obtained set of target hashes is then compared against a database of hashes corresponding to code blocks extracted from whitelisted objects. A target object may be labeled as whitelisted (trusted, non-malicious) if it has a substantial number of hashes in common with a whitelisted object. Objects which are slightly different from known whitelisted objects may still receive whitelisting status. By allowing a certain degree of mismatch between the sets of hashes of distinct objects, some embodiments of the present invention increase the efficiency of whitelisting without an unacceptable decrease in safety.