Malicious Code Analysis via Behavior Characteristic Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-virus systems cannot effectively prevent or remove unknown malicious codes, as they require the virus to occur first and lack proactive measures.
Innovation Solution
A malicious code analysis method and system that receives behavior characteristic data from an electronic apparatus, compares it with malware data using information entropy theory, and provides a precautionary measure by identifying a representative attack code, even if the code is unknown, through a data processing apparatus with a malware library and machine learning algorithms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anti-virus systems are used, then known viruses can be detected and removed, but unknown malicious codes cannot be prevented or protected against
Solution Approach 1:
The system performs preliminary analysis of suspicious files by extracting behavior characteristics and comparing them against malware databases before the malicious code can execute or spread. This proactive approach allows the system to identify and block unknown threats based on their behavioral patterns rather than relying on pre-existing virus signatures.
Solution Approach 2:
The system introduces a data processing apparatus as an intermediary between the electronic apparatus and potential threats. This intermediary analyzes behavior characteristics of suspicious files, compares them with malware databases, and provides precautionary measures, thereby protecting the electronic apparatus from both known and unknown malicious codes.
2Adaptability or versatility
If behavior analysis and comparison methods are implemented, then protection against unknown malicious codes is achieved, but system complexity and processing time increase
Solution Approach 1:
The system divides the malware detection process into distinct modules: behavior characteristic extraction, database comparison, and precaution generation. This segmentation allows each component to be optimized independently and facilitates parallel processing, reducing overall system complexity while maintaining high detection capability.
Solution Approach 2:
The system automatically analyzes suspicious files, compares behavior characteristics with the malware database, and generates precautionary measures without requiring manual intervention. This self-service capability reduces operational complexity and enables rapid response to potential threats.
3Measurement precision
If comprehensive behavior characteristic analysis is performed, then detection accuracy improves, but processing speed decreases
Solution Approach 1:
The system performs partial analysis by first extracting key behavior characteristics and comparing them against the malware database. For files that show suspicious patterns, more comprehensive analysis is then applied. This approach maintains high detection accuracy while reducing average processing time by avoiding full analysis of all files.
Solution Approach 2:
The system continuously updates the malware database with new threat information and maintains ready-state comparison capabilities. This continuous operation allows the system to quickly match new suspicious files against known malware patterns without requiring complete re-analysis, thereby maintaining both accuracy and speed.
Data Source
AI summary
A malicious code analysis method and system, a data processing apparatus, and an electronic apparatus are provided. A behavior characteristic data corresponding to a suspicious file is received from the electronic apparatus via the data processing apparatus to analyze the behavior characteristic data. The behavior characteristic data corresponding to the suspicious file is compared with a malware characteristic data of each of a plurality of malicious codes to obtain a comparison result. And based on the comparison result, a representative attack code corresponding to the suspicious file is obtained and a precaution corresponding to the representative attack code is transmitted to the electronic apparatus.