Automatic Malware Defense Using Binary Branch Map Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems struggle to effectively defend against unknown malware files, either classifying them as benign or requiring human analysis, leading to security risks and delayed defensive actions.
Innovation Solution
A computer-implemented method that automatically secures a system by identifying the closest known malicious binary file (KMBF) through branch mapping and API profiling, and implementing a defense strategy based on matching scores, while also addressing discrepant functions in the suspect binary file (SBF).
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If unknown files are flagged for human analyst assessment, then classification accuracy is improved, but response time deteriorates due to delays in defensive action
Solution Approach 1:
The system performs self-service by automatically analyzing unknown files through multiple classification techniques (signature-based, behavior-based, heuristic analysis) and implementing defense strategies without requiring human analyst intervention. The automated workflow includes quarantine, sandboxing, and threat mitigation actions that were previously dependent on human assessment.
Solution Approach 2:
The system performs preliminary actions by pre-configuring multiple classification methods and defense strategies that are automatically applied to unknown files. Classification rules, behavior thresholds, and mitigation protocols are established in advance, enabling immediate automated response without waiting for human analysis.
2Reliability
If the system is locked down until human assessment is complete, then security reliability is improved, but system functionality deteriorates due to unnecessary restrictions
Solution Approach 1:
The system applies partial action by implementing selective quarantine and mitigation only for specific suspicious behaviors or threat patterns identified through automated analysis. Instead of complete system lockdown, only affected processes or files are restricted, maintaining overall system functionality while addressing specific security threats.
Solution Approach 2:
The system dynamically adjusts security measures based on real-time analysis results. Defense strategies are modified continuously as the automated analysis progresses, allowing the system to transition from permissive to restrictive states only when and where necessary, rather than maintaining static lockdown conditions.
3Productivity
If automated classification into known malware families is implemented, then response speed is improved, but classification accuracy deteriorates when files cannot be classified
Solution Approach 1:
The system implements multi-functionality by combining multiple classification approaches: signature-based matching for known malware, behavior-based analysis for detecting malicious activities, and heuristic analysis for identifying suspicious patterns. This universal approach handles both classifiable and unclassifiable files effectively.
Solution Approach 2:
The system uses behavior-based analysis as an intermediary method when signature-based classification fails. The behavior analysis acts as a mediator that can identify malicious intent even when the file cannot be matched to known malware families, bridging the gap between fast automated response and accurate classification.
Data Source
AI summary
A computer-implemented method of automatically securing a computer system or network against a suspect binary file (SBF) by, in response to detection of the SBF, initiating an automatic defence strategy comprising an action known to mitigate a known threat posed by a closest known malicious binary file (KMBF). The method further includes identifying the closest KMBF from a plurality of KMBFs by comparing an SBF branch map generated in respect of the SBF with respective KMBF branch maps generated in respect of each of the plurality of KMBFs, the SBF and KMBF branch maps being generated by breaking each of the respective binary files down into a respective sequence of blocks and determining how each block of the sequence branches to one or more other blocks of the sequence. Further aspects of the present disclosure relate to corresponding data processing systems, computer programs, computer-readable data carriers and data carrier signals.