Malware Detection via Component Structural Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods rely on signature-based approaches that require frequent updates and fail to identify the source of malware infections, as they focus on individual files rather than analyzing the internal structure of software applications for reused or similar components.
Innovation Solution
The method involves constructing static call graphs to identify reusable components, calculating eccentricity for component extraction, and comparing nested structures across executables to detect potential malware and infer authorship, using techniques like directed graphs and containment graphs to efficiently analyze and match components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based malware detection is used, then detection of known malware is effective, but frequent database updates are required and source identification is not provided
Solution Approach 1:
The patent segments malware analysis from file-level signature matching to component-level structural analysis. By dividing executables into reusable components and analyzing their internal structures, the system can identify malware families and sources without relying on continuously updated signature databases, thus resolving the contradiction between detection reliability and update frequency requirements
Solution Approach 2:
The patent performs preliminary action by pre-analyzing and building structural profiles of malware components before actual detection occurs. The system constructs containment graphs and component relationships in advance, enabling source identification and family classification without requiring real-time database updates, thereby reducing the time loss associated with maintaining signature databases
2Reliability
If entire executables are compared for similarities, then malware detection is possible, but computational complexity and analysis time increase
Solution Approach 1:
The patent applies segmentation by breaking down entire executables into smaller reusable components. Instead of comparing complete binary files which are computationally intensive, the system extracts and compares individual components such as functions, procedures, and code blocks. This segmentation reduces the complexity of malware detection while maintaining reliability through component-level analysis
Solution Approach 2:
The patent extracts reusable components from executables using techniques like dynamic binary instrumentation and control flow graph analysis. By taking out and isolating specific components for comparison rather than analyzing entire executables, the system reduces computational complexity while preserving the ability to detect malware through component similarity analysis
3Reliability
If component extraction and comparison is performed across all size ranges, then comprehensive malware detection is achieved, but computational load increases significantly
Solution Approach 1:
The patent applies local quality by focusing computational resources on analyzing components within specific size and complexity ranges that are most relevant to malware detection. Rather than uniformly analyzing all components regardless of size, the system identifies and prioritizes components with characteristics typical of malware (such as small utility functions or specific code patterns), thereby reducing computational energy consumption while maintaining comprehensive detection capability
Solution Approach 2:
The patent employs partial action by performing component extraction and comparison only on components that fall within predetermined size and complexity thresholds. Instead of exhaustively analyzing every component in an executable, the system selectively processes components that are most likely to contain malware indicators, reducing computational energy consumption while achieving effective malware detection through targeted analysis
Data Source
AI summary
Embodiments of a system and method for computer inspection of information objects, for example, executable software applications for common components that may include elements of computer viruses, items from hacker exploit libraries, or other malware components. Information objects may contain identified sequences of instructions, each of which may be identified and hierarchically grouped based on their structural relationship(s). In the software context, programming languages may include multiple components that include functional code; these components are often shared between programmers. In some embodiments, an inspection of the hierarchical relationship of components (e.g., constituent functions) in the information objects may allow for identification of common components shared between programs. In some embodiments, authorship of objects or components in the objects may be identified by comparisons between component samples. In some embodiments, inspection of the relationship between components is limited to component groups having a specified structural size, complexity, or eccentricity.