Malware Family Tree Generation via Indirect Tag Relationships
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods lack an efficient automated way to organize malware family trees without analyzing source code, making it difficult to understand and mitigate malware attacks effectively.
Innovation Solution
A malware family identification engine constructs a graph data structure to identify indirect relationships between malware instances and families, using a dictionary to link detected tags to malware families, and recursively builds a family tree based on significant indirect entities, allowing for automated generation of malware family trees.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If malware family trees are organized without analyzing source code, then the process becomes more automated and affordable, but the ability to accurately identify family relationships deteriorates
Solution Approach 1:
The patent uses detected tags as intermediary entities that connect malware instances to malware families indirectly. Instead of directly analyzing source code to establish family relationships, the system introduces tags as mediating elements that bridge the gap between malware instances and their families, enabling automated identification while maintaining accuracy through the relational structure of tags.
Solution Approach 2:
The patent extracts the essential identifying features of malware into separate detected tags, separating them from the full source code analysis. By taking out only the critical familial characteristics into tag entities, the system achieves automated family tree generation without requiring complete source code examination, thus balancing automation with identification accuracy.
2Extent of automation
If graph data structures with indirect relationships are constructed, then automated identification capability improves, but system complexity increases
Solution Approach 1:
The patent segments the complex task of malware family identification into distinct components: malware instances, detected tags, and malware families as separate entities in the graph data structure. By dividing the system into these manageable segments with defined relationships, the automated identification capability is enhanced while the complexity is distributed and organized rather than concentrated in a single monolithic structure.
Data Source
AI summary
A malware family identification engine constructs a graph data structure of direct relationships between malware instances and malware families, direct relationships between malware instances and detected tags, and indirect relationships between detected tags and malware families. The engine builds a dictionary data structure comprising detected tag entries linking each detected tag to one or more malware family nodes based on the graph data structure. The engine identifies significant indirect entities (SIEs) within the detected tag entries of the dictionary data structure and selects a SIE with a highest number of out-going links (OGLs) as a root node in a family tree data structure, recursively connects SIEs with a number of OGLs less than the highest number of OGLs to the root node in the family tree data structure, and converts each SIE name in the family tree data structure to a chained family entity name in the family tree data structure.