Malware Detection via Probability Space File Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional antivirus technologies face inefficiencies in detecting malicious files with unique characteristics, often requiring excessive resource usage and failing to detect new or unfamiliar malicious programs, leading to suboptimal detection methods and high false positives.
Innovation Solution
A method involving a mapping model that characterizes files in a probability space to determine their association with known malicious families, allowing for the selection of optimal detection methods based on file characteristics and behavior, thereby optimizing resource usage and improving detection effectiveness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If static analysis is used for malware detection, then resource consumption is reduced and detection speed is improved, but detection accuracy and reliability deteriorate
Solution Approach 1:
The detection system is segmented into multiple independent analysis methods (static analysis, dynamic analysis, heuristic analysis, signature-based detection). Each method operates independently and contributes partial results to the overall detection decision, allowing the system to balance speed and accuracy by combining lightweight static analysis with more thorough dynamic analysis when needed.
Solution Approach 2:
The system performs partial dynamic analysis by emulating only critical code sections rather than full program execution. This partial action provides sufficient behavioral data for detection while consuming fewer resources than complete dynamic analysis, thus improving the speed-accuracy tradeoff.
2Reliability
If dynamic analysis is used for malware detection, then detection accuracy is improved, but resource consumption and detection time increase
Solution Approach 1:
The system extracts and analyzes only the most critical behavioral features and code sections during dynamic analysis, rather than examining the entire program execution. This extraction of essential characteristics maintains high detection accuracy while significantly reducing the computational resources and time required compared to full dynamic analysis.
Solution Approach 2:
Static analysis and signature matching are performed as preliminary actions before dynamic analysis. This preliminary screening identifies obvious malware cases and filters out benign files, so that resource-intensive dynamic analysis is reserved only for suspicious files that require deeper inspection, thereby improving overall detection speed.
3Reliability
If multiple detection methods are applied in succession, then detection reliability is improved, but system complexity and resource usage increase
Solution Approach 1:
The detection system dynamically adapts its complexity by selecting and combining analysis methods based on the specific characteristics of each file being analyzed. The system adjusts the depth and type of analysis performed, using simpler methods for obvious cases and more complex methods only when necessary, thus maintaining high reliability while managing system complexity.
Solution Approach 2:
The system employs a universal detection framework that integrates multiple analysis methods (static, dynamic, heuristic, signature-based) into a single cohesive platform. This multi-functional system can perform various types of analysis through a unified interface, reducing the complexity that would arise from managing separate detection systems for each method.
Data Source
AI summary
A method for detection of malicious files includes training a mapping model for mapping files in a probability space. A plurality of characteristics of an analyzed file is determined based on a set of rules. A mapping of the analyzed file in probability space is generated based on the determined plurality of characteristics. A first database is searched using the generated mapping of the analyzed file to determine whether the analyzed file is associated with a family of malicious files. The first database stores mappings associated with one or more families of malicious files. In response to determining that the analyzed file is associated with the family of malicious files, a selection of one or more methods of malware detection is made from a second database. The second database stores a plurality of malware detection methods. The selected method is used to detect the associated family.