Malware Signature Detection via Database Content Transformation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware scanners are ineffective in detecting advanced malware, particularly injection-based or standalone malware, due to their inability to recognize complex changes in malware signatures, which are constantly evolving.
Innovation Solution
A method and system that applies transformations such as normalization, de-serializing, de-obfuscating, converting to another code page, and unescaping to detect malware signatures in databases, allowing for the remediation of malicious code by replacing or removing infected entries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional malware scanners use identical signature matching, then simple malware can be detected, but advanced malware with complex changes cannot be detected
Solution Approach 1:
The patent applies multiple text transformations (normalization, de-obfuscation, de-serialization, code page conversion, unescaping) to change the parameters of the malware signature representation. These transformations convert obfuscated or encoded malware into recognizable patterns, enabling detection of advanced malware while maintaining compatibility with simple signature matching for basic threats.
Solution Approach 2:
The patent performs preliminary transformations on the database content before scanning for malware signatures. By pre-processing the text through normalization, de-obfuscation, and other transformations, the system prepares the data in advance to reveal hidden malware patterns, making subsequent detection more effective without requiring complex real-time analysis.
2Adaptability or versatility
If malware scanners allow some character differences, then minor variations can be detected, but complex malware changes remain undetected
Solution Approach 1:
Instead of allowing arbitrary character differences, the patent applies specific parameter-changing transformations that convert varied malware representations into standardized forms. This maintains measurement precision by ensuring that only meaningful variations (those not caught by transformation) result in false negatives, while false positives are minimized through targeted transformation approaches.
3Reliability
If transformations are applied to detect obfuscated malware, then detection capability improves, but processing complexity increases
Solution Approach 1:
The patent segments the malware detection process into distinct transformation stages (normalization, de-obfuscation, de-serialization, code page conversion, unescaping). Each stage handles a specific aspect of obfuscation, making the overall complex process manageable and maintainable while improving detection reliability through systematic application of multiple specialized transformations.
Solution Approach 2:
The patent creates a universal detection framework that applies multiple transformations to handle various obfuscation techniques. This multi-functional approach allows a single detection system to reliably detect malware regardless of the obfuscation method used, improving reliability without requiring separate specialized systems for each threat type.
Data Source
AI summary
Disclosed herein are systems and method for detecting malware signatures in databases. In one exemplary aspect, a method may comprise identifying a plurality of entries of the database, wherein each entry represents a record stored on a computing device and selecting at least one suspicious entry in the plurality of entries. The method may comprise retrieving a record associated with the suspicious entry and applying a transformation to original contents of the record. The method may comprise scanning the transformed contents of the record for a malware signature. In response to detecting a portion of the transformed contents that matches the malware signature, the method may comprise executing a remediation action that removes a corresponding portion from the original contents of the record and updating the database by replacing the at least one suspicious entry with an entry of the record on which the remediation action was executed.