Automatic Malware Defence via Branch Map Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems struggle to effectively defend against unknown binary files, as they either incorrectly assume them to be benign or require human analysis, leading to potential security risks and delays.
Innovation Solution
A computer-implemented method that automatically secures a computer system or network by identifying the closest known malicious binary file (KMBF) to a suspect binary file (SBF) through branch mapping and API profiling, and initiating an automatic defence strategy based on the identified KMBF.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If unknown binary files are classified into known malware families for defence, then defence strategy can be implemented, but unknown files cannot be classified introducing security risk
Solution Approach 1:
The patent introduces branch maps as an intermediary representation that translates binary code into a standardized graphical format showing control flow. This mediator enables comparison between unknown malware and known malware families without requiring direct classification, allowing defence strategies to be applied based on structural similarity rather than exact matching.
Solution Approach 2:
The patent creates simplified copies (branch maps) of malware binary files that capture essential control flow characteristics. These copied representations can be quickly compared and matched against known malware patterns, enabling rapid identification and defence strategy application without analyzing the complete original binary files.
2Measurement precision
If unclassifiable unknown files are flagged for human analyst assessment, then accurate classification can be achieved, but delay in defensive action introduces security risk
Solution Approach 1:
The patent performs preliminary automated analysis by generating branch maps and comparing them against known malware families before human analyst involvement. This preliminary action filters out many cases that can be handled automatically, reducing the workload for human analysts and enabling faster defence response for the majority of cases.
Solution Approach 2:
The system enables self-service classification by automatically comparing unknown binary files against known malware families using branch map analysis. The system can independently identify and classify many malware variants without human intervention, reserving human analyst resources for truly novel threats that require expert assessment.
3Reliability
If system/network is locked down during human analyst assessment, then security is maintained, but functionality is restricted to unnecessary extent
Solution Approach 1:
Instead of applying a complete lockdown (excessive action), the patent applies targeted defence strategies based on the specific malware family identified through branch map comparison. This partial action approach neutralizes the specific threat while maintaining normal system functionality for legitimate operations, avoiding unnecessary restrictions.
Data Source
AI summary
One aspect of the present disclosure provides a computer-implemented method of automatically securing a computer system or network against a suspect binary file (SBF) by, in response to detection of the SBF, initiating an automatic defence strategy. The automatic defence strategy includes a first action known to mitigate a known threat posed by a known malicious binary file (KMBF); and a further action predicted to mitigate a predicted threat posed by a discrepant function present in the SBF but not the KMBF. Further aspects of the present disclosure relate to corresponding data processing systems, computer programs, computer-readable data carriers and data carrier signals.