Malware Detection Logic for Mixed Content Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting malware in mixed content files is challenging due to the intermingling of legitimate and malicious instructions, making it difficult to distinguish between benign and malicious functionality.
Innovation Solution
A computer system with malware detection logic that receives mixed content files, executes a series of tests to determine if the file includes malware, and assigns scores based on various criteria such as executable instructions, obfuscation, and suspicious keywords, ultimately deciding whether the file is likely to be malware-free, dubious, or malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple types of content are stored in the same file to enable rich functionality, then the file's versatility and user experience are improved, but the difficulty of detecting malware increases due to intermingled legitimate and malicious instructions
Solution Approach 1:
The patent segments the mixed content file into distinct content types (e.g., HTML, XML, JavaScript, CSS) and applies specialized malware tests specific to each content type. This segmentation allows the detection system to analyze each component with appropriate methodologies, improving detection accuracy while maintaining the file's rich functionality.
Solution Approach 2:
The patent introduces an intermediary malware detection system that acts as a mediator between the mixed content file and the analysis process. This intermediary system coordinates multiple specialized tests, manages the complexity of analyzing intermingled content types, and synthesizes results to determine overall malware presence.
2Adaptability or versatility
If viewer programs support a wide range of functionality to create rich user experiences, then the user experience is improved, but the attack surface for malware exploitation increases
Solution Approach 1:
The patent applies preliminary anti-action by implementing malware detection tests before the viewer program processes the mixed content file. By detecting and blocking malicious instructions in advance, the system prevents malware from exploiting the viewer program's extensive functionality, thereby reducing the attack surface while preserving legitimate features.
3Measurement precision
If malware detection tests are executed on mixed content files to identify malicious instructions, then detection accuracy is improved, but the processing time and system resources increase
Solution Approach 1:
The patent segments the malware detection process into multiple specialized tests, each targeting specific content types or malware characteristics. This segmentation allows for more efficient processing by applying appropriate tests to relevant portions of the file, improving detection accuracy while reducing overall processing time compared to exhaustive analysis of the entire file.
Solution Approach 2:
The patent implements a scoring system where malware tests contribute to an overall risk assessment. Rather than requiring all tests to pass or fail uniformly, the system can make detection decisions based on accumulated scores from a subset of relevant tests, balancing detection accuracy with processing efficiency.
Data Source
AI summary
Computer systems and methods in various embodiments are configured to determine whether a file is likely to be malware-free or include malware. In an embodiment, a computer system configured to improve security of client computers, and comprising: a memory; one or more processors coupled to the memory; a malware detection logic coupled to the memory and the one or more processors, and configured to: receive a first file from a viewer program that is executing on the client computer, wherein the first file is a mixed content file comprising a combination of both executable instructions and data in one or more formats, and/or one or more data sets stored in one or more other formats; determine that the first file is formatted according to a first specification and that the first specification is associated with one or more first malware tests of a plurality of malware tests, wherein each test in the plurality of malware tests is associated with a score; execute each test in the first one or more malware tests, and add, to a first total score, the score associated with the test if the first file satisfies the test; determine the first total score satisfies a first threshold, and in response, send data to the viewer program indicating that the first file is likely to include malware.