Malicious Code Detection via Binary Cycle Statistical Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware, particularly exploit kits like Blackhole and Incognito, utilize obfuscation routines that make them difficult to detect using simple substring matches or regular expressions, wasting resources and potentially compromising user data.
Innovation Solution
A computer-implemented method that converts datasets into binary form using a predefined algorithm, identifies cycles, and performs statistical analysis to determine the presence of malicious software code by comparing results with stored profiles, effectively detecting obfuscated malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If simple substring matches or regular expressions are used to detect malware, then the detection method is simple and fast, but the detection accuracy is low due to obfuscation routines
Solution Approach 1:
The patent transforms the malware detection problem by changing the parameter representation from raw text to binary format. By converting characters to 0s and digits to 1s, the system creates a new parameter space where statistical patterns become detectable, resolving the contradiction between detection accuracy and method complexity
Solution Approach 2:
The patent replaces the mechanical pattern-matching system (substring matches and regular expressions) with a statistical analysis system. Instead of relying on exact text patterns, the new system uses binary conversion and statistical measures (cycle detection, entropy calculation) to identify malware, achieving higher accuracy without excessive complexity
2Reliability
If obfuscation routines are used in malware, then the malware can evade detection, but the resource consumption increases due to wasted system administrator resources and network bandwidth
Solution Approach 1:
The patent converts the harmful obfuscation technique into a beneficial detection feature. By analyzing statistical properties of the binary representation, the system identifies patterns that are characteristic of obfuscated malware. The obfuscation that previously helped malware evade detection now creates distinctive statistical fingerprints that aid detection, thereby reducing resource waste from false negatives and failed security attempts
3Measurement precision
If statistical analysis is performed on binary datasets to detect malware, then the detection accuracy improves, but the processing time and computational complexity increase
Solution Approach 1:
The patent segments the malware detection process into distinct stages: binary conversion, cycle identification, statistical calculation, and threshold comparison. This segmentation allows each stage to be optimized independently, reducing overall processing time while maintaining high detection accuracy through focused computational efforts at each stage
Data Source
AI summary
A system, method, and computer-readable medium for detecting malicious computer code are provided. A dataset may be accessed and converted to a binary dataset according to a predefined conversion algorithm. One or more cycles in the binary dataset may be identified. Statistical analysis may be performed on the identified one or more cycles. A determination that the set of dataset includes malicious software code may be made based on the performed statistical analysis.