Malware Variant Detection via Furl-Based Heuristic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus and anti-malware systems face challenges in detecting malicious data objects due to their instability in recognizing non-functional or cosmetic changes in file signatures, leading to laborious manual intervention for identifying new variants of malware.
Innovation Solution
A heuristic method involving dividing files into pieces, calculating average byte values, generating a 'furl' representation, and determining normalized distance between known and suspect files to identify potential malware variants.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature comparison method is used for malware detection, then detection of exact matches is achieved, but detection of variants with non-functional changes fails
Solution Approach 1:
The file is divided into multiple blocks (e.g., 100 blocks of 256 bytes each), and only the first block is used for furl calculation. This segmentation allows the system to focus on the most significant portion of the file for similarity comparison, enabling detection of variants while maintaining efficiency.
Solution Approach 2:
The patent transforms the file into a normalized representation (furl) by calculating average byte values for each block and normalizing them to a 0-255 range. This parameter transformation makes the representation invariant to non-functional changes in the original file, enabling robust variant detection.
2Adaptability or versatility
If manual analysis is performed to detect new malware variants, then detection of variants is achieved, but time consumption increases
Solution Approach 1:
The system automatically generates furl representations and performs similarity comparisons without requiring manual analyst intervention. The automated heuristic analysis eliminates the need for manual disassembly and comparison, significantly reducing analysis time while maintaining variant detection capability.
Solution Approach 2:
The patent replaces manual mechanical analysis with automated computational algorithms. The furl generation and normalized distance calculation algorithms automatically perform what would otherwise require manual analyst examination, enabling rapid variant detection.
3Reliability
If exact signature matching is used, then detection stability for known malware is maintained, but adaptability to new variants is reduced
Solution Approach 1:
The system dynamically adapts its comparison method based on the file characteristics. By using normalized distance calculation on furl representations, the system can handle both exact matches and variants uniformly, maintaining reliability for known malware while adapting to new variants through the normalized comparison metric.
Solution Approach 2:
The furl-based normalized distance calculation serves multiple functions: it can detect exact matches, identify variants, and distinguish between different malware families. This universal approach replaces the need for separate exact matching and variant detection mechanisms.
4Measurement precision
If conventional file comparison techniques are used, then exact file identity is determined, but similarity between non-identical files cannot be detected
Solution Approach 1:
The patent transforms the file from its original byte sequence representation into a normalized furl representation with values in the 0-255 range. This dimensional transformation enables the system to detect similarity relationships that are not visible in the original file comparison, adding a new dimension to file analysis.
Data Source
AI summary
A system, method and computer program product for identifying new variants of certain data objects, for example, malware-carrying files, including (a) dividing a file into a plurality of N pieces; (b) for each of the N pieces, calculating an average value of bytes in that piece; (c) generating a furl of length N elements, wherein each element of the furl has a value that represents the average value of its corresponding file piece; (d) calculating the distance between the furl and a second furl that corresponds to the file known to contain malware; and (e) based on the distance, determining whether the file is likely to carry a malicious object. The malicious object is, for example, a trojan, a virus, a rootkit or a worm. The second furl can be selected by comparing file size, and taking into account whether the file is packed. The furl elements are bytes, words, half words, etc. The distance is calculated based on, e.g., the sum of absolute value differences, root mean square difference and a correlation coefficient. The average value is an arithmetic average and a geometric average.