Hash Code Search Indexing for Malware Detection Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection technologies rely heavily on pattern signature-based methods, which are inefficient in handling the rapid generation and variation of malware, leading to increased storage requirements and reduced search speeds.
Innovation Solution
A hash function-based search apparatus and method that performs shingling operations on documents, applies MinHash functions to generate hash codes, and indexes these codes to reduce storage space and improve search speed, while determining document similarities for malicious content detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pattern signature-based malware detection is used, then malware can be detected by comparing against known patterns, but storage requirements increase and search speeds decrease due to the rapid generation and variation of malware
Solution Approach 1:
The patent transforms the malware detection approach by changing the parameter representation from full pattern signatures to hash codes. Instead of storing complete malware patterns, the system applies hash functions to generate compact hash code representations, significantly reducing storage requirements while maintaining detection capability through similarity comparison of hash codes.
Solution Approach 2:
The patent extracts the essential identifying features of malware by applying hash functions to generate hash codes. Rather than storing entire malware patterns or full signatures, the system extracts only the critical hash code representation, which captures the essential characteristics needed for detection while discarding redundant information.
2Reliability
If pattern signature-based malware detection is used, then malware can be detected by comparing against known patterns, but search speeds decrease due to the rapid generation and variation of malware
Solution Approach 1:
The patent changes the comparison parameter from full pattern matching to hash code comparison. By transforming malware patterns into hash codes, the system enables faster comparison operations while maintaining detection reliability through similarity measurement of the hashed representations.
Solution Approach 2:
The patent creates simplified copies of malware patterns in the form of hash codes. These hash code copies serve as efficient proxies for the full malware patterns, allowing rapid comparison and similarity assessment without requiring access to the complete original patterns, thus improving search speed.
3Loss of information
If full document indexing is performed, then complete document information is available for search, but index storage space increases
Solution Approach 1:
The patent transforms document representation by applying hash functions to generate hash codes from documents. This parameter transformation reduces the storage footprint of indexed documents while preserving essential information through the hash code representation, which can be used for similarity-based search and comparison.
Solution Approach 2:
The patent extracts essential document characteristics by converting full documents into hash codes. This extraction process captures the core identifying features of documents in a compact form, eliminating redundant information while maintaining the ability to perform effective search and similarity analysis.
Data Source
AI summary
A hash code-based search apparatus includes a token set extracting unit configured to extract a token set having at least one token from a document, a hash code generating unit configured to generate N hash codes by applying N hash functions to the at least one token (where N is a natural number), and an index generating unit configured to generate a search index by indexing the document with the N hash codes.