Malware Detection via Fragmented File Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems struggle to identify hidden malware within files, as it can be embedded in benign-looking file fragments, leading to potential damage to computer networks.
Innovation Solution
The method involves processing a received file into multiple fragments, analyzing each fragment using a machine learning model to identify potentially malicious information, and then combining adjacent fragments to analyze further, ultimately determining the file's maliciousness and performing remedial actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a file is analyzed as a whole using traditional malware detection methods, then the detection process is simple and fast, but hidden malware embedded in benign file fragments cannot be identified
Solution Approach 1:
The patent divides a file into multiple fragments and analyzes each fragment separately using machine learning models. This segmentation approach enables the detection of hidden malware that would be missed in whole-file analysis, as the malware may be concealed within specific fragments while the rest of the file appears benign. The system processes fragments independently and combines results to make a comprehensive malware determination.
2Reliability
If machine learning analysis is performed on every file fragment, then hidden malware detection capability is improved, but the processing time and computational resources increase significantly
Solution Approach 1:
The patent applies machine learning analysis selectively to file fragments rather than processing the entire file with the same level of scrutiny. By analyzing fragments in a hierarchical manner (first level fragment analysis, then combining adjacent fragments for second level analysis), the system achieves high reliability in detecting hidden malware while reducing overall processing time compared to exhaustive whole-file analysis.
3Productivity
If traditional signature-based malware detection is used, then the detection method is fast and resource-efficient, but it cannot detect novel or obfuscated malware hidden in benign fragments
Solution Approach 1:
The patent replaces traditional signature-based mechanical detection methods with machine learning-based analysis. Instead of relying on predefined malware signatures, the system uses trained machine learning models to automatically identify patterns and characteristics of malware hidden within file fragments. This substitution maintains relatively fast processing speeds while dramatically improving the ability to detect novel, obfuscated, and hidden malware that traditional methods would miss.
Data Source
AI summary
In some embodiments, a method includes processing at least a portion of a received file into a first set of fragments and analyzing each fragment from the first set of fragments using a machine learning model to identify within each fragment first information potentially relevant to whether the file is malicious. The method includes forming a second set of fragments by combining adjacent fragments from the first set of fragments and analyzing each fragment from the second set of fragments using the machine learning model to identify second information potentially relevant to whether the file is malicious. The method includes identifying the file as malicious based on the first information within at least one fragment from the first set of fragments and the second information within at least one fragment from the second set of fragments. The method includes performing a remedial action based on identifying the file as malicious.