Malicious File Detection via Node Pattern Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer security systems rely on file hashes to identify malicious files, but minor changes to files can result in different hash values, leading to false positives or missed detections due to small differences in file content.
Innovation Solution
A computer-implemented method using machine learning classification of file attributes to determine a node pattern, calculating a file prevalence score by hashing this pattern, and performing security actions based on the score to identify and mitigate potentially malicious files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If file hash values are used to identify malicious files, then file prevalence can be calculated to detect common files, but minor changes to files result in different hash values leading to false positives or missed detections
Solution Approach 1:
The patent segments a file into multiple blocks and generates separate hash values for each block rather than hashing the entire file. This segmentation allows the system to capture the structural characteristics of files while being tolerant to minor modifications in non-critical blocks, thereby resolving the contradiction between measurement precision and detection reliability
Solution Approach 2:
The patent creates a family of hash values from multiple file blocks that can universally represent variations of the same file. This multi-functional hash approach allows the system to identify both exact matches and minor variations of malicious files, improving detection reliability while maintaining accurate prevalence calculation
2Stability of the object's composition
If traditional hash functions are used on entire files, then file identity can be preserved, but minor modifications cause vastly different hash values that appear uncommon and indicate low file prevalence
Solution Approach 1:
The patent divides files into multiple blocks and generates hash values for each block independently. This segmentation ensures that minor modifications to individual blocks do not completely change the file's identity representation, allowing the system to maintain stable file identification while accurately measuring prevalence
Solution Approach 2:
The patent combines multiple block hash values into a comprehensive file representation that captures the overall file structure. This merging approach maintains file identity stability while being resilient to minor modifications, thereby improving prevalence measurement accuracy
Data Source
AI summary
A computer-implemented method for identifying malicious computer files may include (i) receiving, by a computing device, a set of files from a set of client devices, (ii) performing, by the computing device, a machine learning classification of file attributes on the set of files, (iii) determining, based on the machine learning classification, a node pattern of a suspicious file in the set of files, (iv) calculating, by hashing the node pattern, a file prevalence score of the suspicious file, and (v) performing, by the computing device, a security action based on the file prevalence score of the suspicious file. Various other methods, systems, and computer-readable media are also disclosed.