Genetic Algorithm File Security Module for Unknown Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting maliciously infected computer files, particularly those modified to no longer match known signatures or containing new malware, are not entirely satisfactory, as they rely on signature-based detection and cannot identify files infected with unknown or evolving malware.
Innovation Solution
A method utilizing a computer file security determination module that employs a genetic algorithm and deterministic finite automata to analyze binary representations of files, constructing formal words and regular languages to recognize patterns indicative of healthy or infected files without executing the files, thereby detecting malware regardless of known signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If signature-based detection methods are used to identify malware, then detection speed and simplicity are improved, but the ability to detect unknown or modified malware deteriorates
Solution Approach 1:
The patent replaces traditional signature-based mechanical search methods with a genetic algorithm that evolves detection patterns. Instead of literally searching for known malware signatures, the system uses evolutionary computation to generate and refine detection rules that can identify both known and unknown malware variants based on their structural and behavioral characteristics.
Solution Approach 2:
The detection system is made dynamic through the genetic algorithm's continuous evolution. Detection patterns are not static signatures but dynamically adapting rules that improve over time as the system learns from new malware samples and evolves its detection capabilities to match emerging threats.
2Measurement precision
If files are executed or opened for analysis, then malware detection accuracy is improved, but the risk of malicious software propagation increases
Solution Approach 1:
The system performs preliminary analysis by examining file characteristics, structures, and metadata before execution. The genetic algorithm evaluates static features and patterns in the file's binary representation, allowing detection decisions to be made without actually running the potentially malicious code.
Solution Approach 2:
The patent introduces an intermediary analysis layer that sits between file reception and execution. This layer uses the genetic algorithm to evaluate files based on their structural properties and predicted behavior, acting as a mediator that determines whether files should be allowed to execute based on risk assessment rather than direct observation of malicious actions.
3Reliability
If known malware signatures are updated frequently, then detection of new malware is improved, but system complexity and resource consumption increase
Solution Approach 1:
The system provides self-service through automatic evolution of detection patterns. Rather than requiring manual updates of signature databases by security analysts, the genetic algorithm autonomously generates, tests, and refines detection rules based on observed malware patterns, making the system self-updating and reducing administrative overhead.
Solution Approach 2:
The patent changes the fundamental parameters of malware detection from static signature strings to evolving detection rules with multiple parameters. The genetic algorithm manipulates parameters such as pattern weights, rule priorities, and feature importance, allowing the system to adapt its detection criteria without requiring complete signature replacements.
Data Source
Figure 1~2
Figure 3~5
AI summary
The security of a file is determined by a recognition analysis of a formal word associated with that file, by each regular language of a control individual. The process includes a control phase comprising the steps of associating the file with a formal word, determining the recognition of the formal word by each language of the control individual, and determining the security of the file based on the number of languages that recognized it; and a training phase (P1) comprising the steps of providing a database comprising a plurality of training files, generating (110) individuals, each individual being associated with a health indicator, evolving (120) the individuals including the creation of a new individual and the deletion (124) of individuals, and selecting (130) a corresponding control individual.