Malware Classification via Multi-Source Behavioral Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware systems rely on signature matching and deep analysis, which introduces delays in detecting new malware and requires manual or semi-manual processes, leaving users vulnerable during the analysis period.
Innovation Solution
A method and apparatus for classifying computer objects as malware by comparing data from multiple remote computers, using a hashing process to create a key that represents the object, and monitoring behavior to rapidly determine if an object is malicious without generating new signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature matching and deep analysis are used to detect malware, then detection accuracy is improved, but detection time is increased
Solution Approach 1:
The system performs preliminary actions by collecting and analyzing malware samples from multiple remote computers before a full classification decision is made. This preliminary data gathering and initial analysis reduces the time required for complete deep analysis while maintaining detection accuracy through pre-computed behavioral patterns.
Solution Approach 2:
The malware detection process is segmented into multiple independent components: behavior collection from remote computers, hashing processing, key generation, and classification. This segmentation allows parallel processing of different analysis aspects, reducing overall detection time while maintaining comprehensive accuracy through aggregated results.
2Measurement precision
If manual or semi-manual analysis processes are used to classify malware, then classification accuracy is improved, but processing speed is reduced
Solution Approach 1:
The system implements self-service by automatically collecting behavior data from remote computers, performing hashing operations, generating classification keys, and making malware classification decisions without human intervention. This automation maintains high classification accuracy through consistent application of analysis criteria while dramatically increasing processing speed.
Solution Approach 2:
The system uses feedback mechanisms where classification results from multiple remote computers are aggregated and used to refine and improve future classifications. This feedback loop maintains high accuracy by learning from accumulated data while processing occurs at automated speeds.
3Reliability
If new malware signatures are generated and updated, then protection against new malware is improved, but time delay before protection is available is increased
Solution Approach 1:
The system performs preliminary classification and key generation for new malware samples before they need to be added to signature databases. By pre-processing and pre-classifying malware from remote computers, the system reduces the time delay before protection is available while maintaining reliability through accurate classification.
Solution Approach 2:
The system transitions from traditional signature-based one-dimensional detection to multi-dimensional analysis by collecting behavior data from multiple remote computers, analyzing hashing patterns, and generating classification keys. This dimensional expansion enables faster detection of new malware variants without requiring immediate signature updates.
4Object-affected harmful factors
If obfuscation techniques are used by malware writers, then malware concealment is improved, but detection difficulty is increased
Solution Approach 1:
The system extracts the essential identifying characteristics of malware by generating hashing keys from behavior data, separating these key features from the obfuscated malware code. This extraction process reveals the true nature of concealed malware by focusing on immutable behavioral patterns rather than obfuscated code structures.
Solution Approach 2:
The system changes the detection approach from analyzing the apparent appearance of malware code to analyzing its behavioral fingerprint through hashing. This transformation reveals the true identity of obfuscated malware by converting behavioral data into distinctive classification keys that remain consistent regardless of code obfuscation.
Data Source
AI summary
In one aspect, a method of classifying a computer object as malware includes receiving at a base computer data about a computer object from each of plural remote computers on which the object or similar objects are stored. The data about the computer object received from the plural computers is compared in the base computer. The computer object is classified as malware on the basis of said comparison. In one embodiment, the data about the computer object includes one or more of: executable instructions contained within or constituted by the object; the size of the object; the name of the object; the logical storage location or path of the object on the respective remote computers; the vendor of the object; the software product and version associated with the object; and, events initiated by or involving the object when the object is created, configured or runs on the respective remote computers.