Malware Detection via Executable Attribute Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection techniques relying on blacklists and whitelists are cumbersome and inadequate, as they grow excessively large, consume significant computing resources, and fail to comprehensively detect malware, especially when malicious executables mutate their file content, leading to undetected threats.
Innovation Solution
A malware detection system incorporating a learning engine that uses a prediction model, trained with attributes of executables, to calculate the likelihood of malware presence, and a rule engine that performs countermeasures based on calculated scores, including attributes such as non-standard compilers, embedded URLs, and file signatures, to accurately identify and manage malicious executables.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blacklist and whitelist techniques are used to detect malware, then malware detection capability is provided, but the lists grow excessively large and consume significant computing resources
Solution Approach 1:
The patent transforms the detection approach from comparing against large static lists (blacklists/whitelists) to analyzing dynamic parameters and attributes of executable files. Instead of maintaining exhaustive lists of known malware, the system evaluates multiple attributes (compiler type, embedded URLs, file signatures, etc.) to determine malware likelihood, thereby reducing list size while maintaining detection reliability
Solution Approach 2:
The patent replaces the mechanical list-matching system with a learning-based prediction model. Rather than mechanically comparing file hashes against growing blacklists, the system uses trained models to predict malware presence based on attribute analysis, significantly reducing the computational burden of maintaining and searching large lists
2Reliability
If blacklist and whitelist techniques are used to detect malware, then known malware can be identified, but mutated malware with changed file content goes undetected
Solution Approach 1:
The patent introduces dynamic attribute analysis instead of static list matching. The system evaluates multiple attributes of executable files (compiler information, embedded URLs, import strings, file signatures) that can adapt to identify malware even when the file content mutates. This dynamic approach maintains detection accuracy while improving adaptability to new and mutated malware variants
Solution Approach 2:
The system performs preliminary analysis of executable attributes before execution, training prediction models on these attributes to identify malware patterns. By analyzing attributes like compiler type, embedded URLs, and file structures in advance, the system can detect mutated malware based on characteristic patterns rather than exact file matches
3Measurement precision
If exhaustive attribute analysis is performed on executables, then malware detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent implements a tiered analysis approach where the system evaluates multiple attributes but uses weighted scoring to focus on the most discriminative features. The learning model prioritizes attributes that provide the highest detection accuracy (such as compiler type, embedded URLs, and file signatures) while still considering additional attributes, thereby achieving high detection accuracy without processing every possible attribute in equal detail
Data Source
AI summary
Provided herein are systems and methods for determining a likelihood that an executable comprises malware. A learning engine may determine a plurality of attributes of an executable identified in a computing environment, and a corresponding weight to assign to each of the plurality of attributes. Each of the plurality of attributes may be indicative of a level of risk for the computing environment. The learning engine may generate, according to the determined plurality of attributes and the corresponding weights, one or more scores indicative of a likelihood that the executable comprises malware. A rule engine may perform an action to manage operation of the executable, according to the generated one or more scores.