Malware Detection Rule Generation via Unique Byte Sequence Deconfliction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems face challenges in efficiently identifying unique byte sequences for different malware families and generating accurate detection rules, which can lead to increased false positives and negatives.
Innovation Solution
The technology involves a two-phase approach to identify and generate malware detection rules. In the first phase, unique byte sequences are identified and attributed to specific malware families, with wildcard bytes injected to account for variations. In the second phase, these sequences are deconflicted to ensure uniqueness, reducing false positives and negatives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If malware detection rules are expanded to cover more malware families with more features, then detection coverage is improved, but the number of false positives and false negatives increases
Solution Approach 1:
The patent segments the malware detection process into two distinct phases: (1) identifying byte sequences unique to each malware family, and (2) deconflicting sequences across families. This segmentation allows the system to handle diverse malware families independently while maintaining high accuracy through family-specific unique sequences, resolving the contradiction between broad coverage and false positive reduction.
Solution Approach 2:
The patent applies local quality by generating detection rules tailored to each specific malware family based on its unique byte sequences. Instead of using generic detection rules that apply to all malware, the system creates family-specific rules with localized characteristics (unique byte sequences) that minimize false positives for each family while maintaining overall detection coverage.
2Measurement precision
If more byte sequences are analyzed to improve detection accuracy, then measurement precision is improved, but computational complexity increases
Solution Approach 1:
The patent extracts only the essential unique byte sequences from malware families for rule generation, rather than analyzing all possible byte sequences. By taking out only the distinctive sequences that define each family and excluding redundant or non-unique sequences, the system achieves high detection accuracy while reducing computational complexity to manageable levels.
Solution Approach 2:
The patent performs preliminary actions in the first phase by pre-identifying and storing unique byte sequences for each malware family before actual detection occurs. This preliminary extraction and organization of unique sequences enables fast, accurate detection during runtime without the computational burden of analyzing all possible byte sequences, thus improving measurement precision while controlling complexity.
3Adaptability or versatility
If byte sequences are wildcarded to account for variations, then adaptability is improved, but rule complexity increases
Solution Approach 1:
The patent applies dynamics by using wildcarded byte sequences that can adapt to variations within malware families. The wildcards allow detection rules to dynamically match different variations of the same family members while maintaining a single unified rule structure, improving adaptability without proportionally increasing rule complexity.
Data Source
AI summary
Disclosed are techniques for identifying unique byte sequences for malware families. A method can include receiving a collection of malware signature samples, grouping the samples in the collection by malware family, and for each family: identifying unique byte sequences in the samples and a number of instances of the unique byte sequences across the samples, adding the identified unique byte sequences to a dictionary for the malware family, retrieving a dictionary of at least another malware family, comparing the unique byte sequences in the dictionary for the malware family with byte sequences in the dictionary of the another malware family, identifying a conflicting byte sequence based on (i) the comparison and (ii) determining that a number of instances of the conflicting byte sequence is more than a threshold number of instances, and removing the identified conflicting byte sequence from the dictionary for the malware family.