Malware Classification Using Vantage-Point Trees and Fuzzy Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection techniques are insufficient for detecting variations in files and require significant computing resources, leading to performance degradation and inadequate detection rates.
Innovation Solution
A cyber security method and system using locality-sensitive hashing evaluation with a vantage-point tree structure for initial malware detection, followed by machine learning-based assessment, optimized for speed and computation efficiency, to identify malicious files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional malware detection techniques using file hashes are used, then known malicious files can be detected, but they lack generality to detect variations and new strains of malware
Solution Approach 1:
The patent transforms the malware detection approach by changing from exact hash matching to fuzzy hash matching with similarity scoring. This allows the system to detect not only exact matches of known malware but also variations and new strains by measuring similarity thresholds, thereby improving detection generality while maintaining reliability through configurable similarity cutoffs.
Solution Approach 2:
The system dynamically adjusts detection parameters including similarity thresholds and confidence levels based on the specific file being analyzed. This dynamic approach allows the detector to adapt its sensitivity for different file types and contexts, improving both the generality of detection across variant malware and the reliability through context-aware threshold adjustment.
2Reliability
If comprehensive malware analysis is performed on all files, then detection accuracy improves, but computational resources are significantly consumed degrading device performance
Solution Approach 1:
The detection process is segmented into multiple stages: initial fuzzy hash filtering, similarity scoring, and detailed analysis only for suspicious files. This segmentation allows the system to quickly eliminate benign files using low-resource operations while reserving comprehensive analysis only for files that cross similarity thresholds, thereby maintaining high detection accuracy while minimizing overall computational resource consumption.
Solution Approach 2:
The system performs partial analysis on all files (fuzzy hashing) and excessive/detailed analysis only when necessary (full malware scanning). This selective depth of analysis ensures that computational resources are not wasted on clearly benign files while maintaining thorough examination of potentially malicious files, optimizing the balance between detection accuracy and resource usage.
3Speed
If vantage-point tree structure is used for searching, then search speed improves, but detection rate for malicious malware is insufficient
Solution Approach 1:
The patent merges the vantage-point tree search structure with fuzzy hash similarity scoring and multi-stage filtering. The VPT provides fast initial filtering by organizing files in a searchable hierarchy, while the fuzzy hash matching and similarity scoring layers add the capability to detect malware variants. This combination maintains the speed advantage of structured search while improving detection rate through enhanced similarity-based matching.
Data Source
AI summary
A cyber security method and system for detecting malware via an anti-malware application employing a fast locality-sensitive hashing evaluation using a vantage-point tree (VPT) structure for the indication of malicious files and non-malicious files. The locality-sensitive hashing evaluation using the VPT structure can be performed prior to initiating the deeper, more computationally intensive evaluation and is used to identify with high confidence a scanned file or data object being a malicious file, a non-malicious file, or a low confidence measure of the two.