Network Suspicious File Detection via Hash Prioritization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in identifying suspicious files on a network without prior information, as they often require known harmful or policy-violating files to detect malware or other harmful content.
Innovation Solution
A security device determines a first set of hash values from client devices, analyzes these values to form a prioritized set based on parameters like whitelist, blacklist, and client device quantity, requesting and analyzing the prioritized files to identify suspicious content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing systems analyze all files on the network to identify suspicious content, then detection completeness is improved, but network resources and processing time are excessively consumed
Solution Approach 1:
The patent extracts only the essential identifying feature (hash value) from files and transmits it to the security device for analysis. Instead of analyzing entire files, the system uses hash values as representative identifiers, which are much smaller in size and require minimal processing resources while still enabling effective suspicious file detection.
Solution Approach 2:
The patent changes the analysis parameter from examining complete file contents to analyzing hash value parameters (such as hash algorithm type, hash value format, and statistical properties). This parameter transformation allows the security device to identify suspicious files through mathematical analysis of hash characteristics rather than content inspection, significantly reducing computational overhead.
2Reliability
If the system analyzes hash values from all client devices without prioritization, then comprehensive coverage is achieved, but processing efficiency deteriorates
Solution Approach 1:
The patent segments the set of hash values from all client devices into multiple subsets based on statistical analysis. By dividing the comprehensive dataset into smaller, manageable groups with different risk characteristics, the system can prioritize analysis of high-risk segments while maintaining overall coverage through systematic processing of all segments.
Solution Approach 2:
The patent performs preliminary statistical analysis on hash value parameters before the main suspicious file detection process. This preliminary action identifies and prioritizes hash values that exhibit suspicious characteristics, allowing the security device to focus computational resources on the most likely candidates while still maintaining comprehensive coverage through subsequent analysis of remaining segments.
3Measurement precision
If the system requires prior information about harmful files to detect malware, then detection accuracy for known threats is improved, but the ability to detect novel threats deteriorates
Solution Approach 1:
The patent implements a feedback mechanism where the security device analyzes hash value parameters from multiple sources and uses the results to refine its detection model. The system continuously learns from analyzed hash values, adjusting its understanding of suspicious patterns based on accumulated data, thereby improving detection accuracy for both known and novel threats over time.
Solution Approach 2:
The security device performs self-learning by analyzing the statistical properties and patterns of hash values it receives from client devices. Instead of relying solely on pre-loaded databases of known malware, the system autonomously identifies suspicious patterns through mathematical analysis of hash parameters, enabling it to detect both known threats with high accuracy and novel threats through pattern recognition.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A device may determine a first set of hash values corresponding to a first set of files stored by a plurality of client devices. The device may analyze information associated with the first set of hash values to determine a second set of hash values corresponding to a second set of files to be analyzed. The second set of hash values may be different from the first set of hash values. The device may prioritize the second set of hash values to form a prioritized set of hash values corresponding to a prioritized set of files, of the second set of files, to be analyzed. The device may request the prioritized set of files from one or more client devices of the plurality of client devices. The device may receive the prioritized set of files, and may cause the prioritized set of files to be analyzed.