Malicious File Detection via Selective Data Block Analysis

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current antivirus technologies face challenges in detecting malicious files with unique characteristics that differ from known malicious files, leading to inefficiencies in detection and false alarms, especially when dealing with previously unknown or little-studied malicious behavior.

Innovation Solution

A system and method using machine learning to select data blocks from objects, perform static analysis, and determine a degree of harmfulness based on a trained model, recognizing objects as safe or malicious based on predetermined thresholds, with the option to retrain the model for improved detection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If static analysis is used for antivirus detection, then the analysis speed and resource consumption are improved, but the detection quality and accuracy deteriorate

Engineering Contradiction:
Improveanalysis speedVSAvoiddetection accuracy
Core Design Contradiction:
ProductivityVSMeasurement precision

Solution Approach 1:

The patent divides the file into multiple data blocks and selects specific blocks for analysis based on criteria such as block size, position, and type. This segmentation allows the system to focus computational resources on the most informative parts of the file, maintaining high detection accuracy while reducing overall analysis time and resource consumption.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent applies different analysis strategies to different parts of the file. By selecting specific data blocks that are most likely to contain malicious characteristics and analyzing them in detail, while performing lighter analysis on other blocks, the system achieves high detection quality without the full resource cost of analyzing the entire file.

Inventive Principle:
Principle #3Local quality

2Measurement precision

If dynamic analysis is used for antivirus detection, then the detection quality and accuracy are improved, but the analysis speed and resource consumption deteriorate

Engineering Contradiction:
Improvedetection accuracyVSAvoidanalysis speed
Core Design Contradiction:
Measurement precisionVSProductivity

Solution Approach 1:

The patent performs partial dynamic analysis by selecting and analyzing only the most critical data blocks rather than executing or emulating the entire program. This partial action approach captures sufficient behavioral information to detect malicious files while avoiding the excessive resource consumption and time delays of full dynamic analysis.

Inventive Principle:
Principle #16Partial or excessive action

3Reliability

If traditional signature-based detection is used, then the detection of known malicious files is improved, but the detection of new or unknown malicious files deteriorates

Engineering Contradiction:
Improvedetection of known threatsVSAvoiddetection of unknown threats
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent performs preliminary analysis of file data blocks to extract features and characteristics before final detection. By pre-processing and analyzing key blocks for patterns indicative of malicious behavior, the system builds a foundation for detecting both known threats through pattern matching and unknown threats through anomaly detection, improving adaptability while maintaining reliability.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3474173B1System and method detecting malicious files using machine learning
Publication Date: 2021.03.17 AO KASPERSKY LAB
  • EP3474173B1 patent drawingFigure 1
  • EP3474173B1 patent drawingFigure 2
  • EP3474173B1 patent drawingFigure 3

AI summary

Disclosed are systems and methods for detection of malicious files using machine learning. An example method comprises: selecting one or more data blocks in an object being analyzed based on rules; performing a static analysis on the one or more data blocks to determine a set of features of the one or more data blocks; determining a degree of harmfulness of the object based on the set of features and a model for detection of malicious objects, wherein the model has been trained by a method for machine learning on at least one safe object and one malicious object; recognizing the object is safe when the degree of harmfulness does not exceed a predetermined threshold of harmfulness; and recognizing the object is malicious when the degree of harmfulness of the one or more data blocks exceeds the predetermined threshold of harmfulness.