Malware Detection via File Property Similarity Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods rely heavily on large white list databases, leading to increased complexity and decreased performance, and result in a high number of false positives, which are not effectively reduced.
Innovation Solution
The technique analyzes file properties of suspect files by comparing them with properties of other files within the same folder or sub-folders, using algorithms like the longest common subsequence to determine if a file is benign or malicious based on similarity, thereby reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If large white list databases are used to reduce false positives, then false positive reduction is improved, but device complexity and database size increase
Solution Approach 1:
The patent extracts the essential characteristics needed for malware detection from large white list databases and implements a simplified file property analysis system. Instead of maintaining extensive databases of known good files, the system extracts key file properties (metadata, headers, structural characteristics) and compares suspect files against these extracted features, significantly reducing database size while maintaining detection effectiveness
Solution Approach 2:
The patent applies local quality by focusing analysis on specific file properties and characteristics rather than requiring comprehensive database matching. The system identifies and analyzes particular file attributes (such as file headers, metadata sections, and structural properties) that are locally sufficient for determining malware status, eliminating the need for global database comparisons
2Measurement precision
If large white list databases are updated frequently, then detection accuracy is improved, but performance decreases due to larger database size
Solution Approach 1:
The patent changes the parameters of the detection system by transitioning from database-size-dependent accuracy to property-analysis-dependent accuracy. The system monitors and analyzes file properties (metadata, structural characteristics, headers) that can be evaluated independently of database size, allowing detection accuracy to be maintained or improved while query performance remains high regardless of database scale
3Reliability
If file property analysis is performed on suspect files, then false positives are reduced, but analysis time increases
Solution Approach 1:
The patent applies partial action by performing file property analysis selectively and partially rather than conducting exhaustive examinations. The system analyzes only the most discriminative file properties (such as headers, metadata, and key structural elements) that provide sufficient information for malware classification, avoiding unnecessary analysis of all file contents and thereby reducing analysis time while maintaining false positive reduction
Data Source
AI summary
A virus detection engine determines that a file is suspected of being malware. A property is retrieved, along with the same file property of other executable files within the same folder. If the property value is similar to property values of the other files then the suspect file is benign. If the number of matches is greater than a threshold then the suspect file is benign. Other file properties of the suspect file are compared. If no file properties are similar to properties of the other files then the suspect file is malware and an alert is generated. The longest common subsequence compares property values. The same property value may be added to files within the same folder after these files are installed on the computer but before any detection takes place. A comparison of the same property values concludes that files are not malware, even if they are suspect.