Malware Detection via Belief Propagation Reputation Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection techniques, such as signature string scanning, are becoming less effective due to targeted and polymorphic malware threats that may not be encountered by security analysts, making it difficult to develop reliable signature strings for detection.
Innovation Solution
A method involving the generation of a graph with nodes representing clients and computer files, where domain knowledge is used to determine priors and edge potentials, and probabilities are iteratively propagated to classify files as malicious or legitimate, leveraging the reputation of clients, files, and source domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If signature string scanning is used for malware detection, then detection can be performed with simple methods, but detection accuracy deteriorates against targeted and polymorphic malware
Solution Approach 1:
The patent introduces an intermediary reputation scoring mechanism that mediates between the simple signature scanning approach and the need for accurate malware detection. Instead of relying solely on signature matching, the system uses reputation scores derived from multiple features (file behavior, client reputation, source domain reputation) as an intermediary layer to enhance detection accuracy while maintaining the simplicity of the overall system architecture.
Solution Approach 2:
The patent transforms the detection approach by changing parameters from static signature matching to dynamic reputation scoring. The system evaluates multiple parameters including file characteristics, client reputation, and source domain reputation, combining these parameters through a scoring mechanism to achieve accurate malware detection without requiring complex analysis for each file.
2Measurement precision
If reputation propagation among clients and files is implemented, then malware detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent segments the reputation evaluation system into distinct components: client reputation evaluation, source domain reputation evaluation, and file reputation scoring. Each component operates independently with its own evaluation criteria, and the results are combined through a structured scoring mechanism. This segmentation reduces system complexity by breaking down the overall reputation propagation into manageable, modular parts.
Solution Approach 2:
The system performs preliminary reputation evaluations for clients and source domains before evaluating individual files. By pre-computing reputation scores for these higher-level entities and storing them for reuse, the system avoids redundant calculations when evaluating multiple files from the same client or source, thereby reducing overall system complexity while maintaining high detection accuracy.
Data Source
AI summary
The probability of a computer file being malware is inferred by iteratively propagating domain knowledge among computer files, related clients, and/or related source domains. A graph is generated to include machine nodes representing clients, file nodes representing files residing on the clients, and optionally domain nodes representing source domains hosting the files. The graph also includes edges connecting the machine nodes with the related file nodes, and optionally edges connecting the domain nodes with the related file nodes. Priors and edge potentials are set for the nodes and the edges based on related domain knowledge. The domain knowledge is iteratively propagated and aggregated among the connected nodes through exchanging messages among the connected nodes. The iteration process ends when a stopping criterion is met. The classification and associated marginal probability for each file node are calculated based on the priors, the received messages, and the edge potentials associated with the edges through which the messages were received.