Malware Detection Using Context Factors for Duplicate Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems fail to effectively identify malicious packages that evade detection by using context-based triggers, such as different software profiles or time-based activation, as they rely solely on object ID matching and previous analysis results, missing malicious behavior in changing environments.
Innovation Solution
The enhanced malware detection system considers context factors like software profiles, object characteristics, and time proximity to determine the similarity and potential maliciousness of objects, employing a correlation engine to prioritize and extend behavioral analysis when necessary, ensuring that objects are not deemed duplicates unless context factors match exactly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the system uses object ID matching to determine duplicates, then analysis speed is improved, but detection accuracy deteriorates because context-based malware evasion is not detected
Solution Approach 1:
The patent extends the duplicate detection from a single dimension (object ID) to multiple dimensions by incorporating context factors such as software profile, object characteristics, and time proximity. This multi-dimensional approach allows the system to maintain fast processing while detecting context-based malware evasion techniques that would otherwise be missed.
Solution Approach 2:
The system changes the parameters used for duplicate determination from solely object ID to a composite set including context factors. By dynamically adjusting which context factors are considered based on the analysis stage and object type, the system achieves both speed and accuracy in detecting malicious packages that use context-based triggers.
2Reliability
If the system performs behavioral analysis on all objects, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system performs preliminary static analysis to determine object characteristics and context factors before initiating full behavioral analysis. This preliminary action filters out obvious duplicates and benign objects, allowing behavioral analysis to be performed only on suspicious objects that require it, thus maintaining high accuracy while reducing overall processing time.
Solution Approach 2:
The system dynamically adjusts the depth of analysis based on context factor comparisons. When context factors indicate high similarity to known benign objects, the system reduces analysis depth. When context factors suggest potential malware evasion, the system increases analysis depth, creating a dynamic analysis strategy that optimizes both time and accuracy.
Data Source
AI summary
A malware detection system may be configured to enhance analysis of an object when determining whether results for a previously analyzed object may be applied to the object. The enhanced analysis may employ context factors pertaining to an environment within which the objects operate. If an object identifier (ID) of the object matches the object ID of the previously analyzed object, but one or more of the context factors differ, then the results from the previously analyzed object may not be applied to the object and the object is subjected to further analysis, e.g., behavioral analysis. Yet if the context factors do not differ, then the object may be deemed a duplicate of the previously analyzed object, such that a result (such as an alert or “no action”) of the previously analyzed object may be applied to the object.