Malicious File Detection via Visual Cues and Metadata
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware prevention software is ineffective in identifying new and visually mimicked malicious files, as it relies on comparing files to known malicious samples and does not analyze visual characteristics before user interaction, allowing malicious code to execute unintentionally.
Innovation Solution
A system and method using a convolutional neural network to analyze visual cues and file metadata, decoupling the visual presentation of files from underlying malicious code, allowing for pre-execution detection of malicious files by generating screenshots and classifying them using object detection and maliciousness determination engines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If prior art malware prevention software compares files to known malicious samples using static pattern matching, then detection of known malware is improved, but detection of new and visually mimicked malicious files deteriorates
Solution Approach 1:
The system performs preliminary analysis of the file's visual presentation and metadata before the user interacts with or executes the file. By generating screenshots and analyzing visual characteristics in advance, the system detects malicious files based on their visual properties rather than waiting for execution or relying on known malware signatures, thereby improving detection of new and visually mimicked threats
Solution Approach 2:
The invention transitions from analyzing files in the traditional code/syntax dimension to analyzing them in the visual presentation dimension. By converting file presentations into images and applying convolutional neural networks, the system detects malware based on visual characteristics such as layout, colors, fonts, and graphical elements, adding a new dimension to malware detection that is independent of code analysis
2Measurement precision
If prior art mechanisms rely on API hooking and dynamic behavior inspection, then detection of known malware behaviors is improved, but detection speed and user experience deteriorate
Solution Approach 1:
The system performs visual analysis and metadata extraction before file execution, generating screenshots and analyzing visual characteristics in advance. This preliminary action allows the system to make detection decisions without waiting for dynamic behavior inspection during or after execution, significantly reducing detection time and improving user experience while maintaining high accuracy
3Productivity
If prior art software does not analyze visual characteristics before user interaction, then file execution speed is maintained, but security against social engineering attacks deteriorates
Solution Approach 1:
The system performs visual analysis and metadata extraction before the user interacts with the file, generating screenshots and analyzing visual characteristics in advance. This preliminary security check occurs in the background without requiring user action or delaying file execution, thereby maintaining productivity while providing security against social engineering attacks by detecting visual deception before the user is exposed to it
Solution Approach 2:
The system introduces an intermediary visual analysis layer between the file and the user. By generating screenshots and analyzing visual characteristics as an intermediate step, the system provides security against social engineering attacks without requiring the user to directly interact with potentially malicious content, thus maintaining both security and user experience
Data Source
AI summary
A system and a method for analyzing files using visual cues in the presentation of the file is provided. These visual aids may be extracted using a convolutional neural network, classified, and used in conjunction with file metadata to determine if a provided document is likely to be malicious. This methodology may be extended to detect a variety of social engineering-related attacks including phishing sites or malicious emails. A method for analyzing a received file to determine if the received file comprises malicious code begins with generating an image that would be displayed if the received file is opened by the native software program. Then the image is analyzed, and output is generated. Metadata is also extracted from the received file. Then, a maliciousness score is generated based on the output, the metadata, and a reference dataset.