Multi-file Malware Analysis via Partitioning and Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Analyzing files for malware is computationally expensive and time-intensive, especially when done individually, which can lead to inaccuracies and excessive resource consumption.
Innovation Solution
A multi-file malware analysis approach that executes groups of files in a sandbox environment, using partitioning and scoring techniques to identify individual malware files by partitioning files into segments and modifying malware scores, allowing for concurrent analysis and resource conservation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If files are analyzed individually for malware, then measurement precision is improved, but productivity deteriorates and use of energy increases
Solution Approach 1:
The patent combines multiple files into a single analysis unit, executing them together in a sandbox environment rather than analyzing each file separately. This merging approach maintains detection accuracy by observing file interactions while significantly improving productivity through batch processing and reducing computational overhead from repeated sandbox initialization.
2Measurement precision
If files are analyzed individually for malware, then measurement precision is improved, but use of energy worsens
Solution Approach 1:
Multiple files are merged into a single analysis batch, sharing the sandbox environment and computational resources. This reduces the energy consumption associated with initializing and running separate analysis processes for each file, while maintaining detection precision through observation of file interactions within the shared environment.
3Productivity
If files are analyzed as a group, then productivity is improved, but measurement precision deteriorates
Solution Approach 1:
The patent applies segmentation by dividing the group of files into smaller batches or segments for analysis. This allows the system to maintain the productivity benefits of batch processing while improving precision by reducing the complexity of each analysis group, making it easier to identify the specific malware file within each segment through partitioning techniques.
Solution Approach 2:
The system uses feedback mechanisms by monitoring behavior during group execution and using the results to guide subsequent analysis steps. When malware behavior is detected in a group, the system provides feedback to identify which specific file caused the behavior, allowing precise identification while maintaining efficient group-based processing.
4Productivity
If files are analyzed as a group, then productivity is improved, but loss of time worsens due to sequential processing
Solution Approach 1:
The patent applies preliminary action by executing all files in the group simultaneously within the sandbox environment before any analysis occurs. This parallel execution eliminates sequential processing delays, allowing the system to benefit from both group-based resource efficiency and reduced processing time through concurrent file execution.
Data Source
AI summary
A device may identify a plurality of files for a multi-file malware analysis. The device may execute the plurality of files in a malware testing environment. The device may monitor the malware testing environment for behavior indicative of malware. The device may detect the behavior indicative of malware. The device may perform a first multi-file malware analysis or a second multi-file malware analysis based on detecting the behavior indicative of malware. The first multi-file malware analysis may include a partitioning technique that partitions the plurality of files into two or more segments of files to identify a file, included in the plurality of files, that includes malware. The second multi-file malware analysis may include a scoring technique that modifies a plurality of malware scores, corresponding to the plurality of files, to identify the file, included in the plurality of files, that includes malware.