Malware Detection Rule Evaluation Using File Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection rules face challenges in accuracy due to the risk of false positives, especially when they are over-inclusive and not adequately tested on a comprehensive set of files, leading to incomplete coverage and potential misidentification of benign files as malicious.
Innovation Solution
A method and system that analyze the effectiveness and accuracy of malware detection rules by comparing files detected as malicious to known malicious and benign files, using similarity thresholds to determine rule effectiveness and accuracy, and allowing for further analysis to confirm or correct false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If detection rules are made over-inclusive to detect variations of malware code, then malware detection coverage is improved, but false positive rate increases
Solution Approach 1:
The system performs preliminary testing of detection rules against a comprehensive collection of safe files and malicious files before deploying them to users. This advance testing identifies potential false positives and allows rule refinement before real-world deployment, resolving the contradiction by preparing rules to be both over-inclusive and accurate.
Solution Approach 2:
The system collects feedback from user systems about file detections and uses this information to analyze and refine detection rules. By continuously monitoring actual performance and comparing detected files against known safe and malicious files, the system adjusts rules to maintain high coverage while reducing false positives.
2Loss of time
If detection rules are tested on a limited collection of files, then testing time and resources are reduced, but detection accuracy cannot be guaranteed
Solution Approach 1:
The system creates a comprehensive file collection that serves multiple purposes: testing detection rules, training new rules, and establishing baseline performance metrics. This multi-functional collection allows thorough testing without requiring separate processes for each purpose, improving accuracy while managing time efficiently.
Solution Approach 2:
The system prepares and maintains a pre-assembled collection of safe and malicious files before rule testing begins. This preliminary preparation of test data eliminates the need to gather files during the testing process itself, allowing thorough accuracy testing without proportionally increasing testing time.
3Device complexity
If feedback is based on file checksums or hashes, then false activation detection is simplified, but files with slight variations cannot be properly evaluated
Solution Approach 1:
Instead of relying solely on checksums, the system creates and uses copies of detected files for analysis. By copying files to a testing environment and comparing them against the file collection, the system can evaluate files with slight variations while maintaining manageable processing complexity through automated comparison procedures.
Solution Approach 2:
The system introduces an intermediary comparison process between detected files and the file collection. This intermediary analysis layer, which may use similarity metrics or partial matching, bridges the gap between simple checksum comparison and full file analysis, enabling evaluation of file variations without excessive complexity.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A malware detection rule is evaluated for effectiveness and accuracy. The detection rule defines criteria for distinguishing files having a characteristic of interest from other files lacking that characteristic, for instance, malicious files vs. benign files. The detection rule is applied to a set of unknown files. This produces a result set that contains files detected from among the set of unknown files as having the at least one characteristic of interest. Each file from the result set is compared to at least one file from a set of known files having the characteristic to produce a first measure of similarity, and to at least one file from a set of known files lacking the characteristic to produce a second measure of similarity. In response to the first measure of similarity exceeding a first similarity threshold, the detection rule is deemed effective. In response to the second measure of similarity exceeding a second similarity threshold, the detection rule is deemed inaccurate.