Malware Detection via File Segmentation and Pattern Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for detecting malware, such as virus signatures, are inadequate in identifying sophisticated malware embedded in common files like word processing, spreadsheet, and multimedia files, due to obfuscation techniques, leaving systems vulnerable.
Innovation Solution
A method that identifies and compares portions of a file to stored patterns of known malware, determining matching portions and assigning scores based on their likelihood of being associated with malware, providing information to assist human analysts in determining whether a file is malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional virus signature methods are used to detect malware, then detection is straightforward for known malware, but the method becomes ineffective against sophisticated malware embedded in common files due to obfuscation techniques
Solution Approach 1:
The patent divides the file into multiple portions or segments and analyzes each segment independently against stored patterns. This segmentation allows the system to detect malware even when it is obfuscated or embedded within legitimate-looking file portions, as the malicious patterns will still match against the segmented portions containing the malware code.
Solution Approach 2:
The system performs partial matching by comparing only specific portions of the file against stored malware patterns, rather than requiring a complete file match. This partial action approach enables detection of malware that has been obfuscated or mixed with legitimate code, as long as sufficient malicious portions are present to trigger pattern matches.
2Measurement precision
If virus signatures are used for malware detection, then known malware can be identified, but maintaining signatures becomes difficult in light of obfuscation and other techniques employed by malware authors
Solution Approach 1:
The stored patterns serve multiple functions: they represent known malware signatures, capture obfuscated malware characteristics, and provide a foundation for detecting evolving malware variants. This universal pattern-matching approach eliminates the need to maintain separate signature sets for different malware types or obfuscation techniques, reducing maintenance complexity while improving detection accuracy.
3Productivity
If traditional malware detection methods are employed, then detection speed is fast for simple cases, but the system becomes vulnerable to sophisticated embedded malware
Solution Approach 1:
By segmenting the file into portions and analyzing each segment independently, the system maintains fast processing speeds while improving detection accuracy. The segmentation allows parallel processing of multiple file portions, preserving productivity, while simultaneously enabling detection of embedded malware that may be hidden within specific segments.
Data Source
AI summary
In one embodiment, a method includes identifying a plurality of portions of a file and comparing the plurality of portions of the file to a plurality of stored patterns. The plurality of stored patterns include portions of known malware. The method also includes determining, from the plurality of portions of the file and based on the comparing of the plurality of portions of the file to the plurality of stored patterns, a set of matching portions. The set of matching portions include one or more of the plurality of portions of the file. In addition, the method includes determining a score for each portion in the set of matching portions and providing information regarding the set of matching portions. The information includes the scores determined for each portion of the set of matching portions.