Malware Detection via Object Fingerprint Similarity Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity solutions fail to effectively detect advanced malware, particularly zero-day and polymorphic malware, due to the lack of known signatures and reliance on domain-blacklists, which leads to missed detections and user experience overhead from virtualized behavior detection systems.
Innovation Solution
A system and method for detecting advanced malware through the generation and comparison of object fingerprints, utilizing machine learning and similarity analysis to classify objects as malicious or benign by correlating indicators from object fingerprints with known malware family fingerprints, without compromising user experience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If signature-based detection methods are used, then detection speed is improved, but detection accuracy against zero-day malware deteriorates
Solution Approach 1:
The system performs preliminary analysis of malware samples to extract behavioral indicators and create threat intelligence profiles before actual malware detection. This preliminary action builds a knowledge base of malware characteristics that enables faster and more accurate detection without requiring traditional signatures for each specific malware variant.
Solution Approach 2:
The patent introduces behavioral indicators and threat intelligence profiles as intermediary elements between the malware sample and the detection engine. These intermediaries capture essential malware characteristics without requiring exact signature matches, enabling detection of zero-day malware through indirect behavioral evidence rather than direct signature comparison.
2Reliability
If virtualized behavior detection systems are deployed, then detection capability against advanced malware is improved, but user experience deteriorates due to overhead
Solution Approach 1:
The system extracts only the essential behavioral indicators from malware execution rather than running full virtualized analysis. By taking out only the critical detection features needed for malware identification, the system maintains high detection capability while minimizing the computational overhead that would otherwise impact user experience.
Solution Approach 2:
The patent applies partial action by performing limited behavioral analysis focused specifically on detecting malware characteristics rather than complete virtualized execution. This partial analysis provides sufficient detection capability against advanced malware while avoiding the excessive overhead of full virtualization, thus preserving user experience.
3Device complexity
If domain-blacklist solutions are used, then implementation complexity is reduced, but detection effectiveness against polymorphic malware deteriorates
Solution Approach 1:
The system changes the detection parameters from static domain names to dynamic behavioral indicators and threat intelligence profiles. This parameter change enables detection of polymorphic malware that uses different domains while maintaining relatively simple implementation through automated indicator extraction and matching against known malware behavior patterns.
Data Source
AI summary
A non-computerized method for detection of malware is described. First, an object for analysis is received. Thereafter, the content from the object is extracted and the extracted content is arranged into one or more basic blocks. Each basic block including at least a portion of the content. The object fingerprint is based on an analysis of the one or more basic blocks. Thereafter, the object fingerprint is generated based on an analysis of the one or more basic blocks. Lastly, the object fingerprint is compared to one or more malware family fingerprints to determine if the object is potentially malicious and may be associated with an advanced malware.