Malware Detection Using Visual and Non-Visual Data Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods, particularly signature-based approaches, are ineffective in identifying malware that disguises itself as trusted software by using recognizable icons and images, leading to potential threats being overlooked and users unknowingly facilitating malware attacks.
Innovation Solution
A method that combines the analysis of visual and non-visual elements associated with software packages to determine if they pose a threat, using techniques such as edge detection and comparison with reference images to identify potential malware, and updating databases with trusted and untrusted providers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If signature-based malware detection methods are used, then detection speed and simplicity are improved, but detection accuracy deteriorates for camouflaged malware
Solution Approach 1:
The detection process is segmented into multiple independent analysis modules: visual element extraction, non-visual metadata extraction, and threat determination. Each module processes specific aspects of the software package separately, allowing parallel processing for speed while maintaining comprehensive analysis for accuracy.
Solution Approach 2:
The patent merges visual analysis (icon/images) with non-visual analysis (metadata, filenames, functions) into a unified detection approach. By combining these previously separate detection dimensions, the system achieves both speed through automated multi-parameter evaluation and accuracy through cross-validation of multiple data sources.
2Device complexity
If visual elements alone are analyzed for malware detection, then processing simplicity is improved, but detection reliability deteriorates
Solution Approach 1:
The system transitions from two-dimensional visual analysis to multi-dimensional analysis by incorporating non-visual metadata dimensions (filenames, functions, network behavior, registry keys). This dimensional expansion increases reliability through cross-validation while maintaining processing simplicity through automated multi-parameter evaluation.
Solution Approach 2:
The detection system uses a composite approach combining multiple types of data (visual icons, metadata, functional behavior, network characteristics) to form a comprehensive assessment. This composite material strategy ensures reliability by requiring consistency across multiple data sources rather than relying on any single indicator.
3Measurement precision
If comprehensive analysis of all software package elements is performed, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system performs preliminary extraction and categorization of all software package elements into visual and non-visual groups before comprehensive analysis. This preliminary organization enables efficient processing by pre-structuring the data, allowing the system to quickly assess multiple parameters without time-consuming real-time analysis during the threat determination phase.
4Ease of operation
If visual similarity to trusted providers is detected, then user trust is improved, but security risk increases
Solution Approach 1:
The system uses the visual similarity to trusted providers as a detection signal rather than accepting it as a guarantee of safety. By recognizing that camouflaged malware deliberately replicates trusted images, the system converts this previously harmful disguise into a useful detection feature, flagging such similarities for further investigation.
Solution Approach 2:
The system introduces comprehensive metadata analysis as an intermediary layer between visual appearance and security decision. This intermediary examination of filenames, functions, network behavior, and registry keys mediates between the deceptive visual elements and the actual security status, allowing the system to distinguish between legitimate and malicious software despite visual similarities.
Data Source
AI summary
Visual and non-visual elements associated with the candidate files are analyzed to determine whether the candidate files are malware. A visual element (e.g., icon) is extracted from the candidate file, and the icon's image is compared to a group of reference images associated with trusted entities. If the icon's image matches a reference image, the candidate file may be malware masquerading as trusted software. The non-visual elements associated with the candidate file are used, in combination with the visual elements, to determine whether the candidate file is malware.