Genericized Malware Signatures via Invariant Byte Discovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods rely on signatures that can be inefficient due to polymorphic malware and variations in byte sequences, requiring numerous signatures to detect all variations, which can lead to inefficiencies and false positives.
Innovation Solution
A method for creating genericized signatures by determining invariant byte sequences and using wildcards to represent variations, with a system that evaluates and processes byte sequences to generate a set of genericized signatures that can detect malware effectively while limiting the number of signatures and wildcards to prevent inefficiencies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional hash-based signatures are used to detect malware, then detection accuracy for specific malware instances is improved, but the system requires many different signatures to detect all variations of polymorphic malware, increasing device complexity and reducing productivity
Solution Approach 1:
The patent creates universal wildcarded signatures that can detect multiple variations of polymorphic malware simultaneously. Instead of requiring separate signatures for each malware variant, a single wildcarded signature pattern can match multiple instances by using wildcard characters to represent variable byte sequences, thereby reducing the total number of signatures needed while maintaining detection accuracy
Solution Approach 2:
The patent transforms fixed byte sequence signatures into wildcarded signatures by changing the parameter representation from exact byte values to patterns with wildcards. This allows the signature system to accommodate variations in malware byte sequences while maintaining a manageable number of signatures
2Measurement precision
If traditional hash-based signatures are used to detect malware, then detection accuracy for specific malware instances is improved, but the evaluation time and processing overhead increase due to the large number of signatures required
Solution Approach 1:
By creating universal wildcarded signatures that can match multiple malware variations, the system reduces the total number of signature evaluations needed. Instead of evaluating many specific signatures against each malware instance, fewer wildcarded signatures are evaluated, significantly reducing processing time and evaluation overhead
3Adaptability or versatility
If the number of wildcards in signatures is increased to improve generic detection, then the ability to detect polymorphic malware is improved, but false positives increase and detection reliability deteriorates
Solution Approach 1:
The patent applies wildcards selectively at specific positions within byte sequences rather than uniformly across all positions. By identifying which byte positions are most variable across malware variations and applying wildcards only at those locations, the system maintains high generic detection capability while minimizing false positives through localized wildcard placement
Solution Approach 2:
The patent uses a limited number of wildcards at strategically chosen positions rather than excessive wildcards throughout the entire signature. This partial application of wildcards provides sufficient generic detection capability while maintaining reliability by avoiding over-generalization that would lead to false positives
Data Source
AI summary
A method for creating a set of genericized signatures for detection of byte sequences in computer code includes accessing a first set of sample signatures, determining a maximum number of wildcards that a wildcarded signature may comprise, determining a first wildcarded signature corresponding to the first set of sample signatures, evaluating the first wildcarded signature, and repeating the steps of evaluating for any second wildcarded signatures. Each of the signatures corresponds to an instance of malware. The evaluation further includes if the number of wildcards in the first wildcarded signature exceeds the maximum number of wildcards, determining a plurality of second wildcarded signatures corresponding to a plurality of subsets of the set of sample signatures. The evaluation further includes if the number of wildcards in the first wildcarded signature is less than or equal to the maximum number of wildcards, adding the first wildcarded signature to a set of genericized signatures.