Malware Detection via Binary String Substring Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems often overlook large strings in binary files, which can contain malicious substrings, leading to undetected malware and reduced detection efficiency due to scalability and performance issues.
Innovation Solution
A system that utilizes a security engine to analyze binary files by identifying and comparing strings and substrings against a suspicious string database, even for large strings exceeding predefined lengths, to categorize files as potentially malicious, with features like static analysis and cloud-based verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If large strings in binary files are analyzed for malware detection, then detection precision is improved, but device complexity and processing time increase
Solution Approach 1:
The patent segments large strings into smaller substrings for analysis. Instead of analyzing entire large strings at once, the system divides them into manageable substrings that can be processed individually against the suspicious string database, reducing memory requirements and processing complexity while maintaining detection capability.
Solution Approach 2:
The patent extracts only the necessary substrings from large strings for analysis. Rather than processing entire large strings, the system identifies and extracts specific substrings that are likely to contain malicious indicators, reducing the volume of data to be analyzed while preserving detection accuracy.
2Measurement precision
If large strings are analyzed for malware detection, then detection precision is improved, but processing speed decreases
Solution Approach 1:
By segmenting large strings into smaller substrings, the system enables parallel processing of multiple substrings simultaneously. This segmentation allows the processing to be distributed and optimized, maintaining high detection precision while improving overall processing throughput and speed.
Solution Approach 2:
The system applies partial action by analyzing only the necessary substrings from large strings rather than processing every byte. This selective analysis approach maintains detection precision by focusing on relevant portions while significantly reducing the total processing time and computational resources required.
3Reliability
If comprehensive string analysis is performed on all binary files, then malware detection reliability is improved, but productivity decreases
Solution Approach 1:
The segmentation of large strings into substrings enables efficient batch processing and parallel analysis across multiple files. This approach maintains comprehensive analysis coverage for reliability while improving productivity by reducing the computational burden on individual processing units and enabling scalable deployment.
Solution Approach 2:
By extracting only the essential substrings from large strings for analysis, the system reduces the volume of data requiring processing while preserving the detection of malicious content. This extraction approach maintains high reliability by focusing on relevant indicators while significantly improving processing throughput and productivity.
Data Source
AI summary
Particular embodiments described herein provide for an electronic device that can be configured to identify a binary file, identify strings in the binary file, determine that at least one string in the binary file is larger than one kilobytes of data, identify at least one substring from each of the at least one strings in the binary file is larger than one kilobytes of data, and analyze each of the at least one substrings to determine if each of the at least one substrings are suspicious and related to malware.