Malware Analysis Abstraction for Operation Log Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Signature-type detection methods struggle to effectively cope with new types of malware due to their customized nature, and existing techniques fail to accurately analyze similarity in operation logs, leading to decreased accuracy in malware analysis.
Innovation Solution
A malware analysis device that generates abstraction information from operation logs, calculates similarity with known malware logs, and specifies software matching a similarity criterion, using abstraction rules to delete or modify less important information and employing methods like Manhattan distance calculation and shortest edit script analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-type detection is used to detect malware, then detection accuracy for known malware is improved, but the ability to detect new types of malware deteriorates
Solution Approach 1:
The patent transforms operation logs from unstructured data into structured data with standardized parameters and fields. This parameterization enables consistent comparison across different malware samples by normalizing diverse log formats into a common structure, allowing both signature matching and behavioral analysis to work effectively together
Solution Approach 2:
The patent segments operation logs into distinct structured components including process information, file operations, network communications, and registry modifications. Each segment is assigned specific parameters that can be independently analyzed, enabling multi-dimensional comparison between malware samples
2Loss of information
If operation logs are stored as unstructured data to preserve all operation information, then information completeness is improved, but similarity analysis accuracy deteriorates
Solution Approach 1:
The patent applies parameter transformation by converting unstructured log entries into structured records with defined parameters such as process ID, operation type, target object, and timestamp. This structured representation preserves all operational information while enabling precise similarity measurement through parameter-based comparison
Solution Approach 2:
The patent introduces a structured data format as an intermediary layer between the raw operation logs and the similarity analysis process. This intermediary structure maintains complete information from the original logs while providing a standardized interface for accurate similarity calculation
Data Source
AI summary
In order to analyze, efficiently and with high precision, the similarity in operation between software that is being examined and a known malware, this malware analysis device 40 is equipped with: an abstraction unit 41 for generating first abstraction information 410 obtained by abstracting first operation information 440 which indicates the result of an operation of sample software; an abstraction information storage unit 45 for storing second abstraction information 450 obtained by abstracting second operation information which indicates one or more operation results obtained for each piece of software that has been compared with the sample; a calculation unit 42 for calculating the similarity between the first abstraction information 410 and the second abstraction information 450; and a specifying unit 43 for specifying the compared software for which the similarity satisfies a criteria.