Malware Functionality Detection via Descriptor Indexing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The manual process of reverse engineering malware to understand its functionality is slow and requires expensive expert labor, necessitating an automatic method for malware capability identification based on commonly available technical documents.
Innovation Solution
A method involving the reception of descriptors from a network, storage in a database, generation of a database index, extraction of file components, identification of relevant descriptors, and inference of a measure of likelihood of file functionality, which is then transmitted to a user.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual reverse engineering is used to understand malware functionality, then detection accuracy can be achieved, but the process is slow and requires expensive expert labor
Solution Approach 1:
The patent creates a copy of malware functionality information by extracting code components from malware samples and associating them with functionality descriptors obtained from web technical documents. This copied information is stored in a database that can be automatically queried, replacing the need for manual reverse engineering while preserving detection accuracy.
Solution Approach 2:
The system enables self-service by automatically extracting code components from malware, querying the database for associated functionality descriptors, and generating functionality inferences without requiring expert intervention. The automated inference engine processes malware samples independently, significantly improving productivity.
2Loss of information
If manual reverse engineering by experts is performed, then comprehensive functionality understanding is achieved, but the cost of expert labor increases
Solution Approach 1:
The patent copies functionality information from web technical documents into a structured database format, associating code components with their functional meanings. This copied knowledge base enables automated systems to understand malware functionality without requiring expensive expert labor, while maintaining comprehensive functionality understanding.
Solution Approach 2:
The patent introduces an intermediary inference engine that mediates between raw malware code components and functionality understanding. This intermediary automatically queries the database, combines multiple descriptors, and generates functionality inferences, replacing the need for expert intermediaries while preserving comprehensive functionality analysis.
3Productivity
If automatic detection methods are implemented, then productivity and efficiency improve, but the complexity of the detection system increases
Solution Approach 1:
The patent segments the malware detection system into distinct modular components: a database module for storing descriptors, an extraction module for obtaining code components, and an inference engine for analyzing functionality. This segmentation improves productivity through automated processing while managing complexity through clear module boundaries and specialized functions.
Data Source
AI summary
In some embodiments, a method includes receiving a plurality of descriptors via a network. Each descriptor includes at least one of a descriptor component or a keyword. The method further includes storing the plurality of descriptors in a database, and generating a database index of the plurality of descriptors based on at least one of the descriptor component or the keyword for each descriptor of the plurality of descriptors. The method further includes storing the database index in the database. The method further includes receiving a file component extracted from a file and identifying, based on the file component, a set of descriptors from the plurality of descriptors. The method further includes inferring, based on the set of descriptors, a measure of likelihood of a functionality associated with the file, and transmitting an indication of the measure to a user.