Malicious File Detection via Selective Data Block Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus technologies face challenges in detecting malicious files with unique characteristics that differ from known malicious files, leading to inefficiencies in detection and false alarms, especially when dealing with previously unknown or little-studied malicious behavior.
Innovation Solution
A system and method using machine learning to select data blocks from objects, perform static analysis, and determine a degree of harmfulness based on a trained model, recognizing objects as safe or malicious based on predetermined thresholds, with the option to retrain the model for improved detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If static analysis is used for antivirus detection, then the analysis speed and resource consumption are improved, but the detection quality and accuracy deteriorate
Solution Approach 1:
The patent divides the file into multiple data blocks and selects specific blocks for analysis based on criteria such as block size, position, and type. This segmentation allows the system to focus computational resources on the most informative parts of the file, maintaining high detection accuracy while reducing overall analysis time and resource consumption.
Solution Approach 2:
The patent applies different analysis strategies to different parts of the file. By selecting specific data blocks that are most likely to contain malicious characteristics and analyzing them in detail, while performing lighter analysis on other blocks, the system achieves high detection quality without the full resource cost of analyzing the entire file.
2Measurement precision
If dynamic analysis is used for antivirus detection, then the detection quality and accuracy are improved, but the analysis speed and resource consumption deteriorate
Solution Approach 1:
The patent performs partial dynamic analysis by selecting and analyzing only the most critical data blocks rather than executing or emulating the entire program. This partial action approach captures sufficient behavioral information to detect malicious files while avoiding the excessive resource consumption and time delays of full dynamic analysis.
3Reliability
If traditional signature-based detection is used, then the detection of known malicious files is improved, but the detection of new or unknown malicious files deteriorates
Solution Approach 1:
The patent performs preliminary analysis of file data blocks to extract features and characteristics before final detection. By pre-processing and analyzing key blocks for patterns indicative of malicious behavior, the system builds a foundation for detecting both known threats through pattern matching and unknown threats through anomaly detection, improving adaptability while maintaining reliability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are systems and methods for detection of malicious files using machine learning. An example method comprises: selecting one or more data blocks in an object being analyzed based on rules; performing a static analysis on the one or more data blocks to determine a set of features of the one or more data blocks; determining a degree of harmfulness of the object based on the set of features and a model for detection of malicious objects, wherein the model has been trained by a method for machine learning on at least one safe object and one malicious object; recognizing the object is safe when the degree of harmfulness does not exceed a predetermined threshold of harmfulness; and recognizing the object is malicious when the degree of harmfulness of the one or more data blocks exceeds the predetermined threshold of harmfulness.