Icon Identification via Image Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems are inefficient in reliably identifying icons due to their reliance on resource-intensive hashing systems, which can be defeated by minor changes in icon appearance, leading to false negatives and the activation of malicious PE files disguised as legitimate ones.
Innovation Solution
A method that exploits the well-defined format of .ico files associated with PE files, creating a known/clean icon database to compare extracted icon image data from suspicious files with known icons, reducing the need for large hashing databases and improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hashing systems (e.g., MD5) are used to identify icons, then icon identification can be performed, but the system becomes resource intensive requiring large databases and significant processing cycles
Solution Approach 1:
The patent extracts only the essential icon image data from the PE file resource section, separating the icon identification task from the full file analysis. By extracting just the icon bitmap data and comparing it against a database of known icons, the system avoids the need for comprehensive hashing of entire files, thereby reducing processing resources while maintaining identification reliability
Solution Approach 2:
The patent creates a database of known icon images as references and extracts icon data from suspicious PE files to compare against these copies. This copying approach allows for efficient pattern matching without requiring complex hashing algorithms, reducing computational resources while maintaining reliable icon identification
2Reliability
If hashing systems are used to identify icons, then icon identification can be performed, but minor changes in icon appearance cause the icon to go unidentified
Solution Approach 1:
The patent changes the identification parameter from hash values (which are sensitive to any modification) to visual pattern matching of icon images. By comparing the actual icon bitmap data against stored known icons using image similarity algorithms, the system can tolerate minor appearance changes such as color shade variations or pixel additions/removals while still identifying the icon correctly
3Ease of operation
If hashing systems are used for icon identification, then a systematic approach is provided, but false negatives occur leading to activation of malicious PE files
Solution Approach 1:
The patent performs preliminary extraction of icon data from PE files before final malware determination. By extracting and analyzing the icon images separately and comparing them against a database of legitimate icons, the system can identify malicious PE files that disguise themselves as legitimate applications, preventing false negatives and improving overall detection reliability
Data Source
AI summary
A method and apparatus for indentifying Icons whereby a known/clean file Icon database is created that includes Icon image data and/or .ico files associated with known icons of selected applications. The resource section of any file being transferred to, or through, a given user computing system is then stripped and scanned for .ico files and any .ico files identified are extracted. Then for each directory extracted from the identified .ico files, the relevant image data is extracted. The known/clean Icon image data is obtained from the known/clean file Icon database. The extracted relevant image data is then compared with known/clean Icon image data and, if the extracted relevant image data matches with the known/clean Icon image data to a desired level of accuracy, a status of the extracted .ico files, and/or given file, is transformed indicate a status of Icon match.