Malware Detection via Server-Side Hash Aggregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods face challenges in identifying unique or rare malware, especially those using obfuscating packers, which can evade traditional signature-based detection and consume significant processing resources, and are often targeted to specific individuals or companies, making them difficult to detect.
Innovation Solution
A method involving a server that receives signature information from a client device, queries a database for matching entries, and if no match is found, waits for a predetermined period to gather further requests from other devices to determine if the file is likely malware, with options for further checks and verification processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional signature-based malware scanning is used, then detection capability for known malware is improved, but processing resource consumption increases significantly
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing hash values of legitimate files in a database before they are needed for detection. When a file needs to be checked, its hash is computed and compared against the pre-stored database, avoiding the need to scan the entire file content during detection. This shifts the computational burden to a preliminary setup phase, reducing real-time processing resources.
Solution Approach 2:
The patent creates a copy of the file's essential identifying特征 (hash value) and stores it in a database for comparison purposes. Instead of analyzing the entire original file during detection, the system uses this copied hash representation, which consumes minimal storage and processing resources while maintaining detection accuracy for known files.
2Reliability
If signature databases are expanded to cover more malware variants, then malware detection coverage is improved, but the size of the database and processing time increase
Solution Approach 1:
The patent extracts only the essential identifying特征 (hash value) of each file and stores it in the database, rather than storing complete file signatures or large portions of file content. This extraction approach maintains the ability to detect malware variants while significantly reducing the quantity of data stored in the database, thus improving detection coverage without proportionally increasing database size.
3Object-affected harmful factors
If obfuscating packers are used to protect malware, then malware can evade detection, but legitimate files may also be obfuscated causing false positives
Solution Approach 1:
The system performs preliminary hashing of files, and since hashing is a deterministic process that produces consistent results for identical input data, obfuscation layers that do not alter the underlying payload will produce the same hash. This allows the system to detect obfuscated malware by comparing hashes against the database, maintaining detection accuracy while not triggering false positives from legitimate obfuscated files.
Data Source
Figure 1
Figure 2
AI summary
A method and apparatus for a determining whether an electronic file stored at a client device is malware. A server receives from the client device a request message that signature information of the electronic file. The server queries a database of signature information of a multiplicity of electronic files. If the signature information of the electronic file corresponds to signature information stored on the database, a determination is made as to whether the electronic file is malware. If the signature information of the electronic file does not correspond to signature information stored on the database, a determination is made as to whether a predetermined number of further request messages for the electronic file are received from further client devices within a predetermined time period. If fewer request messages are received within the time period, it is likely that the electronic file is malware.