Malicious File Detection via Functional Dependency Rule Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus technologies face inefficiencies in detecting new or modified malicious files, often resulting in low detection rates and high false alarm percentages, especially when dealing with files that have not been previously identified or have been altered.
Innovation Solution
A method and system that extract resources from electronic files, form rules based on functional dependencies, and compare these with a database of malicious file resources to calculate a similarity score, determining a file as malicious if the score exceeds a predetermined threshold, using techniques such as artificial neural networks and hash sums for pattern recognition.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If static analysis is used to detect malicious files, then the detection speed is improved and resource consumption is reduced, but the detection accuracy decreases and false alarm rate increases
Solution Approach 1:
The patent segments the file analysis into two distinct phases: static analysis (extracting resources and forming rules without execution) and pattern matching (comparing extracted rules against known malicious patterns). This segmentation allows the system to benefit from the speed of static analysis while incorporating the accuracy of pattern recognition, resolving the contradiction between detection speed and accuracy.
Solution Approach 2:
The patent introduces an intermediary layer of rule extraction and pattern matching that bridges static analysis and dynamic analysis. Instead of directly comparing raw file contents, the system extracts functional rules and dependencies as an intermediary representation, then matches these against known malicious patterns. This intermediary step enhances detection accuracy while maintaining the resource efficiency of static analysis.
2Measurement precision
If dynamic analysis is used to detect malicious files, then the detection accuracy is improved, but the detection speed decreases and resource consumption increases
Solution Approach 1:
The patent extracts only the essential functional rules and dependencies from the file without executing the entire program. By taking out and analyzing only the critical resource interactions and functional dependencies rather than performing full dynamic execution, the system achieves high detection accuracy with significantly reduced resource consumption and faster detection speed.
Solution Approach 2:
The patent applies partial action by performing static analysis on selected key resources and their functional dependencies rather than complete dynamic execution. This partial analysis approach captures sufficient information for accurate detection while avoiding the overhead of full program execution, thus improving detection speed without sacrificing accuracy.
3Measurement precision
If signature analysis is used to detect malicious files, then the detection accuracy for known threats is improved, but the ability to detect new or modified threats decreases
Solution Approach 1:
The patent changes the detection parameters from fixed signature matching to flexible rule-based pattern matching. Instead of relying on exact signature matches, the system extracts functional rules and dependencies that can be matched against patterns of malicious behavior. This parameter change enables the system to detect both known threats (through pattern matching) and new or modified threats (through rule-based analysis of functional dependencies).
Data Source
AI summary
A system and method is provided for determining whether an electronic file is malicious. An exemplary method includes extracting resources from an electronic file; forming a first rule that establishes a functional dependency between the extracted resources; identifying, in a database of malicious file resources, a second rule associated with one or more of the extracted resources; comparing the formed first rule with the identified second rule to calculate a degree of similarity between first and second rules; and determining the electronic file to be a malicious file when the calculated degree of similarity exceeds a predetermined threshold value.