Malware Classification via Compression Function Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for classifying data files to detect malware are inefficient, as they often require feature extraction, which consumes device resources and can lead to unauthorized access if malware is not detected promptly.
Innovation Solution
A method involving a user device that determines a combined data set of query, clean, and malicious files, calculates compression functions, compares these functions to determine similarity, and classifies files without feature extraction, using a security application to identify likely malware-containing files based on similarity and difference metrics.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If feature extraction is used for malware detection, then detection accuracy is improved, but device resource consumption increases
Solution Approach 1:
The patent extracts only the essential characteristic - file compression ratios - rather than performing comprehensive feature extraction. By focusing on this single key metric that naturally reflects malware behavior (malware typically has different compression characteristics than clean files), the system achieves effective detection without the resource overhead of traditional feature extraction methods
Solution Approach 2:
The patent uses simple, computationally inexpensive compression function calculations instead of complex feature extraction algorithms. These compression-based metrics serve as lightweight proxies that consume minimal device resources while still providing sufficient discrimination between clean and malicious files
2Reliability
If comprehensive file analysis is performed, then malware detection reliability is improved, but processing time increases
Solution Approach 1:
The patent segments the file analysis process into distinct compression-based metrics (e.g., overall compression ratio, compression of different file sections). This segmentation allows the system to evaluate multiple aspects of file behavior through simple compression operations rather than performing one comprehensive but time-consuming analysis
Solution Approach 2:
The patent performs preliminary compression function calculations on the file before full analysis. These initial compression metrics provide early indicators of malicious content, allowing the system to make quick assessments and potentially avoid more time-consuming analysis steps for obviously clean or malicious files
Data Source
AI summary
A method including determining a combined data set including query data files that are to be classified, clean data files that are known to be free of malware, and malicious data files that are known to include malware; calculating respective compression functions for each of the query data files, each of the clean data files, and each of the malicious data files; individually comparing each respective compression function with each other respective compression function to determine degrees of similarity between contents included in the data files; determining a plurality of clusters based on the degrees of similarity between contents included in the data files; and classifying each query data file as a file that is likely free of malware or as a file that likely includes malware based on analyzing the combination of the query data files, the clean data files, and the malicious data files in each cluster.