Malware Definition Generation via Word-Level String Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for generating malware definitions are time-consuming, prone to errors, and require manual supervision, making them inefficient for automatic detection and protection against newly identified malware.
Innovation Solution
A method that automatically generates malware definitions by extracting strings from malicious applications, filtering them using safe strings, segmenting into component words, scoring based on word statistics, and selecting candidate strings to create a definition, allowing for detection of new and modified malicious strings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual methods are used to identify and isolate code strings for malware definitions, then reliability of definition creation can be maintained, but the process becomes time-consuming and less productive
Solution Approach 1:
The patent segments the malware definition creation process into distinct automated stages: extracting code strings from malware samples, filtering out safe strings using known safe string databases, scoring remaining strings based on malware characteristics, and selecting high-scoring strings as malware definition signatures. This segmentation enables automated processing while maintaining reliability through systematic validation at each stage.
Solution Approach 2:
The patent introduces an intermediary scoring mechanism that evaluates extracted code strings against multiple criteria including frequency in malware samples, presence in safe string databases, and characteristic patterns. This intermediary scoring system acts as a mediator between raw extracted strings and final malware definitions, automating the selection process while maintaining quality control.
2Reliability
If manual supervision is applied to ensure accuracy in malware definition generation, then error rates decrease, but the complexity of the process increases and automation is reduced
Solution Approach 1:
The system performs self-service through automated extraction, filtering, scoring, and selection of malware definition strings. The automated scoring mechanism independently evaluates each extracted string against established criteria, and the system automatically selects high-scoring strings without requiring manual review, thereby maintaining high automation levels while ensuring accuracy through systematic evaluation.
Solution Approach 2:
The patent implements feedback mechanisms where the scoring system continuously refines string selection based on evaluation results. High-scoring strings are selected for malware definitions, and this feedback loop allows the system to automatically adjust and improve definition quality over time without manual intervention, balancing automation with accuracy.
3Measurement precision
If comprehensive filtering and scoring of malware strings is performed, then detection precision improves, but the complexity of the processing system increases
Solution Approach 1:
The patent segments the complex filtering and scoring process into manageable modular components: extraction module, filtering module against safe string databases, scoring module with multiple evaluation criteria, and selection module. This segmentation reduces system complexity by organizing functions into independent, reusable modules while maintaining comprehensive processing capability.
Solution Approach 2:
The patent applies local quality by implementing different filtering and scoring strategies for different types of code strings. The scoring mechanism evaluates strings based on their specific characteristics, applying appropriate criteria locally to each string rather than using a uniform approach, thereby improving detection precision without requiring overly complex global processing rules.
Data Source
AI summary
Methods and systems are provided for automatically generating malware definitions and using generated malware definitions. One example method generally includes receiving information associated with a malicious application and extracting malware strings from the malicious application. The method further includes filtering the malware strings using a set of safe strings to produce filtered strings and scoring the filtered strings to produce string scores by evaluating words of the filtered strings based on word statistics of a set of known malicious words. The method further includes selecting a set of candidate strings from the filtered strings based on the string scores and generating a malware definition for the malicious application based on the set of candidate strings. The method also includes performing one or more security actions to protect against the malicious application, using the malware definition.