Malware Detection via Execution Chain Clustering

The patent segments the malware detection problem by decomposing infection techniques into discrete, identifiable units called 'atomic techniques.' Each technique is independently characterized and stored in a database, allowing the system to analyze individual technique components rather than treating malware as monolithic entities. This segmentation enables flexible recombination and matching of techniques against known malware families.

The patent transforms the detection approach by changing parameters from static signature matching to dynamic technique profiling. Instead of relying on fixed malware signatures, the system characterizes malware families based on sequences of atomic techniques, their parameters, and execution chains. This parameter transformation allows the system to detect malware based on behavioral patterns rather than static features, enabling detection of evolved variants.

The patent introduces dynamics into the detection system by implementing continuous learning and adaptation mechanisms. The system dynamically updates its understanding of malware families through technique profiling, sequence analysis, and execution chain tracking. As malware evolves, the system adapts by learning new technique variations and updating its detection models, transforming from a static to a dynamic detection approach that improves over time.

The patent implements feedback loops where detection results, technique profiles, and execution chain data are continuously fed back into the system. This feedback mechanism allows the system to learn from detected malware, refine technique characterizations, and improve future detection accuracy. The feedback loop ensures that as malware evolves, the system receives information about new variants and adjusts its detection parameters accordingly.

The patent extracts and isolates the essential detection logic into separate, manageable components. Execution chains are built and analyzed as distinct entities, and technique profiles are extracted from malware behavior. By separating these detection functions into independent modules (execution chain builder, technique profiler, cluster analyzer), the system manages complexity through modularization while maintaining high detection precision.

The patent introduces intermediary structures to bridge complex analysis and simple detection decisions. Execution chains serve as intermediaries between raw malware behavior and detection conclusions. Technique profiles and sequence patterns act as intermediary representations that simplify the matching process. These intermediaries transform complex malware characteristics into standardized formats that can be efficiently compared against known malware families.