Graph Database Malware Label Inference
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The growing threat of polymorphic malware makes it difficult for anti-malware software to detect and classify files effectively, as the polymorphic nature of malware results in varying byte content within executable files of the same family, complicating recognition and grouping.
Innovation Solution
The integration of file properties such as file paths, names, source domains, IP protocol ASNs, section checksums, and digital signatures into a graph database system, which analyzes these properties to infer malware labels using a graph analyzer and machine learning techniques, allowing for reliable classification of files into malware families.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If polymorphic malware is used to vary byte content in executable files, then the malware can evade detection by traditional anti-malware software, but it becomes difficult to recognize and group files into malware families
Solution Approach 1:
The system changes from analyzing byte content parameters to analyzing graph-based property parameters. Instead of relying on fixed byte patterns that polymorphic malware changes, the system extracts properties (file paths, names, source domains, IP protocol ASNs, section checksums, digital signatures) and represents them as graph nodes and edges, enabling classification based on structural relationships rather than mutable byte content
Solution Approach 2:
The patent introduces a graph database as an intermediary between the raw file properties and the classification decision. The graph analyzer processes the complex relationships between multiple properties, using machine learning algorithms to infer malware labels based on the overall graph structure rather than individual byte patterns, thus mediating the classification challenge
2Productivity
If traditional byte-content analysis is used for malware detection, then simple malware can be detected, but polymorphic malware with varying byte content cannot be reliably classified
Solution Approach 1:
The graph-based property analysis system serves multiple functions simultaneously: it captures file metadata, establishes relationships between files and their sources, performs structural analysis, and enables classification. This universal approach works for both simple and polymorphic malware, whereas traditional byte-content analysis only works for simple malware with fixed patterns
Solution Approach 2:
The patent replaces the mechanical byte-by-byte scanning system with a graph-based analytical system. Instead of mechanically comparing byte sequences, the system uses graph theory and machine learning to analyze relationships between file properties, substituting the mechanical detection approach with a more sophisticated analytical framework
Data Source
AI summary
Systems and methods are described which integrate file properties that in conventional systems has been considered weaker evidence of malware and analyzes the information to produce reliable results. Properties such as file paths, file names, source domains, IP protocol ASNs, section checksums, digital signatures that are not always present and not always reliable can be integrated into the classification process using a graph. A 1-neighborhood of object values in the graph may be created and analyzed to suggest a malware family label based on files having similar properties.