Malicious File Detection via Static Resource Dependency Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus technologies face inefficiencies in detecting new or modified malicious files, as they often rely on signature-based methods that are less effective for unknown threats and may generate high false alarm rates, especially when resources are limited.
Innovation Solution
A method and system that utilize static analysis by extracting resources from files, forming rules based on functional dependencies, and comparing these with a database of malicious file resources to determine similarity, with the option to delete or quarantine files when a predetermined threshold of similarity is exceeded, employing artificial neural networks and pattern recognition for enhanced detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If signature analysis is used to detect malicious files, then detection speed is improved, but detection effectiveness for new or modified malicious files deteriorates
Solution Approach 1:
The patent segments the file into multiple resources (icons, dialogs, menus, strings, bitmaps, cursors) and analyzes their functional relationships. This allows the system to detect malicious files based on the structural relationships between resources rather than relying on complete signature matches, thereby improving detection of new or modified malicious files while maintaining analysis speed.
Solution Approach 2:
The patent transitions from analyzing files in one dimension (signature matching) to multiple dimensions by examining functional dependencies between different resource types. The system creates rules that define relationships between resources (e.g., icon-resource relationships, dialog-resource relationships), enabling detection through multi-dimensional pattern recognition rather than single-dimension signature comparison.
2Reliability
If dynamic analysis with execution or emulation is used, then detection effectiveness is improved, but resource consumption and analysis time increase
Solution Approach 1:
The patent performs preliminary static analysis by extracting resources and establishing functional dependency rules before any execution or emulation takes place. This preliminary structuring of the file data enables faster subsequent analysis and reduces the need for resource-intensive dynamic analysis, as the system can identify malicious patterns through pre-established resource relationship rules.
Solution Approach 2:
The patent creates a structural model or copy of the file's resource relationships without executing the actual file. By analyzing the copied structural data and comparing it against known malicious patterns in the database, the system achieves effective detection while avoiding the resource consumption associated with running or emulating potentially harmful code.
3Measurement precision
If traditional antivirus methods are used, then detection of known malicious files is improved, but false alarm rate increases for new or modified files
Solution Approach 1:
The patent changes the detection parameters from fixed signature strings to flexible functional dependency relationships between resources. By comparing the structural relationships (e.g., which icons are associated with which dialogs, how menus connect to underlying functionality) rather than fixed code patterns, the system maintains high precision for detecting malicious files while reducing false alarms, as the functional relationships are more likely to be preserved in malicious variants but differ in legitimate files.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method is provided for determining whether an electronic fife is malicious. An exemplary method includes extracting resources from an electronic file; forming a first rule that establishes a functional dependency between the extracted resources; identifying, in a database of malicious file resources, a second rule associated with one or more of the extracted resources; comparing the formed first rule with the identified second rule to calculate a degree of similarity between first and second rules; and determining the electronic file to be a malicious file when the calculated degree of similarity exceeds a predetermined threshold value.