Malware Detection Rule Generation via Representative Fingerprint Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting malware in files is challenging due to the vast number of new files created daily, making it difficult for anti-malware software to effectively identify and remove malicious files.
Innovation Solution
A system and method that automatically generate rules for detecting malware by determining a representative fingerprint from a set of nearest neighbor fingerprints, analyzing clusters, and creating a final rule to identify malicious files, which can be applied to determine if a file is malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual analysis of each file is performed to detect malware, then detection accuracy is improved, but productivity deteriorates due to the vast number of new files created daily
Solution Approach 1:
The patent creates simplified copies of malware files called 'shadows' that retain only the essential characteristics needed for detection. These shadows are generated by analyzing malware files and extracting key features, then using these features to create representative patterns that can quickly identify malicious files without requiring full file analysis, thus maintaining detection accuracy while dramatically improving processing speed
Solution Approach 2:
The patent transforms the detection approach by changing parameters from analyzing complete file contents to analyzing extracted features and characteristics. By converting files into feature vectors and using machine learning models to process these transformed representations, the system achieves both high detection accuracy and efficient processing of large volumes of files
2Measurement precision
If complex rule generation processes are used to improve malware detection, then detection accuracy is improved, but device complexity increases
Solution Approach 1:
The patent implements self-service through automated shadow generation and rule creation processes. The system automatically analyzes malware samples, extracts features, generates shadows, and creates detection rules without requiring manual intervention. Machine learning models automatically learn from the data and generate detection patterns, eliminating the need for complex manual rule configuration while maintaining high detection accuracy
Data Source
AI summary
Systems and methods automatically determine rules for detecting malware. A fingerprint representing a file is received. A set of nearest neighbor fingerprints from at least a set of malware fingerprints that are nearest neighbors are determined. The set of malware fingerprints are analyzed to determine a representative fingerprint. A malicious file detection rule is generated based, at least in part, on the representative fingerprint.