Intelligent Hashes for Polymorphic Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods using cryptographic hash functions are inefficient due to false negatives from polymorphic malware variants, requiring large sets of hashes that increase scanning inefficiencies as the number of malware entities grows.
Innovation Solution
Generating intelligent hashes that are robust to small changes by identifying metadata such as compression information, frequently occurring subsequences, and unique strings, allowing for centralized evaluation and reduced false negatives through similarity scoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic hash functions are used to identify malware, then malware detection is performed, but false negatives occur due to polymorphic malware variants having different hashes
Solution Approach 1:
The patent segments the malware entity into multiple components: header information, body information, and extracted features (compression information, frequently occurring subsequences, unique strings). By segmenting the analysis into these parts and generating multiple hash values from different segments, the system can identify polymorphic malware even when some segments vary, resolving the contradiction between hash specificity and detection reliability
Solution Approach 2:
The patent changes the parameters used for hash generation from simple cryptographic hashes of the entire entity to multiple hash values derived from specific features and segments (header hash, body hash, compression information hash, subsequence hash, unique string hash). This parameter transformation allows the system to maintain detection reliability while reducing false negatives from polymorphic variants
2Reliability
If a large set of hashes is used to compensate for false negatives, then malware detection coverage improves, but scanning efficiency decreases
Solution Approach 1:
The patent extracts only the most relevant and discriminative features from malware entities (compression information, frequently occurring subsequences, unique strings) to generate hash values. By taking out only these key features rather than hashing entire entities or using exhaustive hash sets, the system achieves comprehensive detection coverage while maintaining high scanning efficiency
Solution Approach 2:
The patent creates a universal hash generation mechanism that produces multiple hash values from a single malware entity analysis. These hashes serve multiple functions: identifying the specific malware variant, detecting polymorphic variants through similarity scoring, and enabling efficient comparison against a database. This multi-functional approach improves detection coverage without requiring proportionally more hashes, thus maintaining scanning efficiency
3Reliability
If multiple hashes are generated for each malware entity, then false negative identifications are reduced, but the complexity of hash management increases
Solution Approach 1:
The patent performs preliminary organization of multiple hash values during the hash generation phase, structuring them in a predetermined format that includes headers, bodies, and feature-based hashes. This preliminary structuring simplifies subsequent management, storage, and comparison operations, reducing the complexity burden that would otherwise arise from managing multiple unstructured hash values
Data Source
AI summary
A suspicious entity is identified. An intelligent hash for the suspicious entity is generated, wherein the intelligent hash includes a set of metadata that is specific to the suspicious entity and at least some of the metadata is invariant over changes to the suspicious entity. The intelligent hash is transmitted to a server for evaluation of whether the suspicious entity corresponds to the malware entity. The server is adapted to determine whether the suspicious entity corresponds to the malware entity based on the intelligent hash. A result is received from the server specifying whether the suspicious entity corresponds to the malware entity.