Malware Detection via Behavioral Hash Fingerprints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods, such as signature and hash sum analysis, fail to detect modified malware code, and behavioral analysis can reduce system performance, necessitating an improved method for effective malware detection without performance degradation.
Innovation Solution
A system and method using hash-based fingerprints, where an executable program's API calls are monitored to generate a MinHash fingerprint, which is compared to known malware fingerprints, allowing for real-time detection of malicious behavior without significant performance impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If behavioral analysis is used to detect modified malware, then detection accuracy is improved, but system performance is reduced
Solution Approach 1:
The patent extracts only the essential behavioral characteristics of malware by monitoring specific API calls and system events, rather than performing comprehensive behavioral analysis. It extracts key indicators such as file creation, registry modifications, and network connections, which are then hashed and compared against known malware patterns. This selective extraction maintains detection accuracy while significantly reducing processing overhead and system performance impact.
Solution Approach 2:
The patent changes the parameter representation from detailed behavioral traces to compressed hash values. By transforming raw behavioral data into hashed fingerprints using algorithms like MinHash, the system reduces the complexity and size of data while preserving essential identification characteristics. This parameter transformation enables efficient comparison and detection without the computational burden of full behavioral analysis.
2Productivity
If signature analysis is used to detect malware, then detection speed is improved, but detection accuracy for modified malware deteriorates
Solution Approach 1:
The patent introduces dynamic behavioral fingerprinting that adapts to modified malware. Instead of relying on static signatures that break with modifications, the system dynamically generates fingerprints based on actual runtime behavior and system interactions. This dynamic approach allows the detection mechanism to identify malware even when its code structure has been modified, while maintaining the speed benefits of hash-based comparison.
Solution Approach 2:
The patent uses behavioral fingerprints as an intermediary between the malware's actual behavior and the detection system. Rather than directly analyzing complex behavioral patterns or relying on fragile static signatures, the system creates an intermediate representation (hash-based fingerprint) that captures essential malicious characteristics. This intermediary enables both fast comparison and robust detection of modified malware.
Data Source
AI summary
Detecting malware includes monitoring an event stream for an executable program, where the event stream includes a plurality of events such as API call events. A first plurality of hash values is determined for the event stream. In response to an occurrence of a trigger event in the event stream, the first plurality of hash values for the event stream can be compared with a second plurality of hash values that represents an event stream for a known malware executable. A determination can be made if a behavior represented by the first plurality of hash values is a permitted behavior based on the comparison.