GUID Attribute Clustering for Polymorphic PE File Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional antivirus software lacks the ability to effectively detect and differentiate between various Potentially Unwanted Applications (PUAs) due to their polymorphic nature, which is exacerbated by frequent updates and use of packers and crypters, making it difficult to keep up with new versions and identities.
Innovation Solution
A system and method for .Net PE file malware detection that accesses portable executable (PE) files, identifies identical global user identifier (GUID) attributes, clusters files with matching GUIDs, generates signatures, and sets exoneration criteria based on acceptable software standards to determine if files are PUA or malware, with additional GUID attributes providing proof of polymorphism.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional antivirus software uses traditional signature-based detection, then it can identify known malware, but it cannot detect polymorphic PUAs that constantly change their identity
Solution Approach 1:
The patent segments the PE file into multiple components and extracts multiple GUID attributes (ModuleVersionID, TypeLib, etc.) from different segments. This segmentation allows the system to analyze individual components separately and combine their information for comprehensive identification, enabling detection of polymorphic variants that may modify individual segments while maintaining overall structural characteristics.
Solution Approach 2:
The patent creates a universal detection mechanism that works across multiple PUA families by identifying common GUID attribute patterns. The system extracts and compares GUID attributes from different PE files to establish family relationships, allowing a single detection approach to identify various polymorphic variants belonging to the same malicious family, thereby achieving multi-functionality in detecting diverse threats.
2Reliability
If antivirus software maintains a database of known malware signatures, then it can identify existing threats, but it cannot keep up with frequently updated PUA versions
Solution Approach 1:
The patent performs preliminary extraction and analysis of GUID attributes from PE files to establish family clusters before actual detection is needed. By pre-processing and organizing GUID attribute data into cluster structures, the system prepares detection templates in advance, enabling rapid identification of new variants without requiring time-consuming updates when new threats emerge.
Solution Approach 2:
The system implements feedback mechanisms where detected PUA samples are analyzed to extract their GUID attributes and update the family cluster database. This feedback loop allows the system to learn from newly detected threats and automatically update its detection capabilities, reducing the time required to adapt to new PUA versions through continuous improvement based on actual detection results.
3Measurement precision
If the system clusters files into family groups based on GUID attributes, then it can identify polymorphic patterns, but it increases the complexity of the detection process
Solution Approach 1:
The patent changes the detection parameters from traditional signature matching to GUID attribute analysis. By focusing on specific parameters (ModuleVersionID, TypeLib, and other GUID attributes) rather than entire file signatures, the system achieves precise polymorphism detection while simplifying the comparison process. This parameter transformation allows efficient clustering based on key identifying features rather than complex full-file analysis.
Data Source
AI summary
A system and method for .Net PE files malware detection is provided. The method may include accessing two or more portable executable (PE) files and detecting at least one identical global user identifier (GUID) attribute. In response to finding identical GUID attributes, the method may include clustering a group of files into family clusters each having the same GUID attribute. The method may generate and release a signature for the family cluster. An exoneration criteria level may be set in accordance with matching characteristics associated with an acceptable software standard for the computing system or network, such that when the exoneration criteria level is reached, the PE file is exonerated from being associated with PUA or malware. Until this criterion is met, the PE file will be identified as PUA or malware. Additional GUID attributes may be identified as further proof that the PE file is polymorphic.