Malware Detection via Hash Reputation and Remote Code Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malware detection methods rely heavily on local database updates for signature-based detection and network-based hash look-ups, which are limited by database dependency and specificity, respectively, making them ineffective against evolving malware variants.
Innovation Solution
A method involving generating a hash of a suspected malware entity on a client computer, sending it to a network server for reputation analysis, and if unknown, executing remote code to gather further information iteratively until a decision on malware status is made, combining local and network-based techniques for enhanced generality and accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection and heuristic detection are used with local databases, then the ability to detect known malware is improved, but the ability to detect new malware variants is worsened due to database dependency
Solution Approach 1:
The patent combines signature-based detection, heuristic detection, and hash-based network queries into a unified multi-layered detection system. This merging allows the system to leverage the strengths of each method: signature-based detection for known malware patterns, heuristic detection for suspicious behaviors, and hash-based queries for rapid identification of known malware families, thereby improving both detection accuracy and adaptability to new threats
Solution Approach 2:
The detection system is designed to perform multiple functions: it can detect known malware through signatures and hashes, identify new variants through heuristic analysis, and adapt to evolving threats by learning from network-shared information. This multi-functionality enables a single system to address both detection precision for known threats and generality for unknown threats
2Device complexity
If network-based full-file hash queries are used, then the need for local database updates is reduced, but the ability to provide generic protection is worsened due to cryptographic hash specificity
Solution Approach 1:
The patent segments the detection approach by using cryptographic hashes for rapid identification of known malware families while combining this with heuristic analysis for detecting variants. This segmentation allows the system to use hash-based queries for their intended purpose (rapid known-malware identification) while supplementing them with more generic detection methods for new variants, thereby reducing database management complexity without sacrificing detection generality
Solution Approach 2:
The system introduces an intermediary layer of heuristic analysis between the cryptographic hash query and the final detection decision. This intermediary allows the system to first quickly identify known malware through hashes, then apply heuristic analysis to detect variants and generalize protection, effectively bridging the gap between specific hash-based detection and generic protection
Data Source
AI summary
A method of detecting malware on a client computer, the method including generating a hash of an entity at the client computer, whereby the entity is suspected to be malware, sending the hash to a network server, considering the reputation of the hash at the network server by comparing the hash to a database of hashes of known reputation, returning the results of said considering to the client computer, and, if the reputation is not known at the server, sending instructions to the client computer for obtaining further information about the entity at the client computer, wherein said further information is obtained by executing code at the client computer sent by the server to the client computer after said considering the reputation if said code is not stored at the client computer before said generating a hash.