Malware Detection via Functional Code Block Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional malware detection methods rely on signature-based approaches that are ineffective against evolving malware variants, leading to high false positive rates and delayed detection of unknown threats, which can result in system infections before definitions are released.
Innovation Solution
A system and method for identifying and characterizing executable code functionality by tokenizing and refactoring functional code blocks, comparing them to generic representations of malicious code, and quarantining malware, even when it evades traditional identification methods such as obfuscation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based malware detection is used, then known malware can be identified, but unknown malware variants and evasive malware cannot be detected
Solution Approach 1:
The malware detection system segments the malware binary into multiple functional code blocks, each representing a distinct functionality. This segmentation allows the system to analyze individual functional units independently, enabling detection of unknown malware by comparing functional segments rather than requiring complete signature matches.
Solution Approach 2:
The system extracts functional code blocks from malware binaries, isolating specific functionalities such as file manipulation, network communication, and registry operations. This extraction enables the system to identify and classify malware based on its functional components rather than relying on overall binary signatures.
2Adaptability or versatility
If heuristics techniques are used to identify unknown viruses, then detection capability improves, but false positive rate increases
Solution Approach 1:
The system replaces heuristic analysis with a structured functional comparison mechanism. Instead of using probabilistic heuristics that evaluate various file properties, the system uses deterministic functional block matching against a database of known malware functionalities, significantly reducing false positives while maintaining detection capability.
Solution Approach 2:
The system applies different analysis methods to different functional code blocks within the malware. Each functional block is evaluated based on its specific characteristics and compared against corresponding blocks in the malware database, allowing for precise local assessment rather than global heuristic evaluation.
3Adaptability or versatility
If behavior-based technology is used, then malware execution can be monitored, but damage may occur before blocking and user interaction is required
Solution Approach 1:
The system performs preliminary analysis of malware binaries by extracting and comparing functional code blocks before the malware is executed. This preliminary functional classification enables the system to identify malicious intent in advance, preventing malware execution and potential damage without requiring user interaction during the detection process.
4Reliability
If traditional signature-based virus protection is used, then defined malware can be blocked, but detection is delayed until definitions are released
Solution Approach 1:
The system performs preliminary functional analysis of malware binaries immediately upon detection, extracting functional code blocks and comparing them against the database before any blocking actions are taken. This enables immediate identification and blocking of known malware variants without waiting for signature definition updates.
Solution Approach 2:
By segmenting malware into functional blocks and maintaining a database of known malicious functional patterns, the system can quickly match and identify known malware variants through efficient block comparison, reducing the time required for detection and response compared to traditional signature scanning.
Data Source
AI summary
In embodiments of the present invention improved capabilities are described for the steps of identifying a functional code block that performs a particular function within executable code; transforming the functional code block into a generic code representation of its functionality by tokenizing, refactoring, or the like, the functional code block; comparing the generic code representation with a previously characterized malicious code representation; and in response to a positive correlation from the comparison, identifying the executable code as containing malicious code.