Malware Detection via Fuzzy Behavior Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems are inefficient in identifying and tracing suspicious activity across multiple computing devices, especially under greedy attack models, where malware can spread quickly, leading to significant damage and financial loss.
Innovation Solution
A method that utilizes fuzzy matching of software behavior sequences to generate detailed traces of malware activity, allowing for rapid detection and communication of precursor indicators across devices, enabling parallel and sequential detection to capture and describe suspicious activity effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional malware detection methods are used, then detection accuracy may be maintained, but detection speed and response time deteriorate significantly under greedy attack models
Solution Approach 1:
The system performs preliminary action by capturing and storing behavior sequences at normal speed before attacks occur. When an attack is detected, the pre-captured behavior sequences enable rapid detection and tracing without needing to analyze every event in real-time, thus achieving fast detection while maintaining accuracy through pre-analyzed behavioral patterns.
Solution Approach 2:
The system segments malware detection into two phases: (1) capturing behavior sequences at normal speed for later analysis, and (2) rapid matching against captured sequences during attacks. This segmentation allows the system to maintain high detection accuracy through thorough analysis while achieving fast response times during actual attacks by comparing against pre-captured patterns.
2Measurement precision
If detailed instrumentation is applied to all devices continuously, then detection accuracy improves, but system resource consumption and complexity increase
Solution Approach 1:
The system applies partial instrumentation by capturing behavior sequences at normal speed without full detailed instrumentation. Detailed tracing is activated only when approximate matches are found, applying excessive detail only where needed. This reduces overall system complexity while maintaining detection accuracy by focusing detailed analysis on suspicious activities.
Solution Approach 2:
The system performs preliminary capture of behavior sequences at normal operating speed without heavy instrumentation overhead. Detailed instrumentation is then applied selectively based on matches against captured sequences, reducing continuous resource consumption while maintaining detection accuracy through targeted detailed analysis.
3Speed
If fast matching algorithms are used, then detection speed improves, but measurement precision of behavior sequence matching deteriorates
Solution Approach 1:
The matching process is segmented into two stages: (1) fast approximate matching to identify potential matches, and (2) precise verification of matched sequences. This segmentation enables the system to achieve high detection speed through rapid filtering while maintaining matching precision through subsequent detailed verification of identified candidates.
Solution Approach 2:
The system applies partial precision by using fast approximate matching for initial screening, accepting some imprecision for speed. Precise matching is then applied excessively only to the small subset of sequences that pass the approximate match threshold, achieving both high speed and accuracy by concentrating precise analysis where it is most needed.
Data Source
AI summary
A method of malware detection includes performing, by a second device of a plurality of devices on a network, a fuzzy matching between a second sequence of events occurring at the second device and a first sequence of captured events that occurred at a first device of the plurality of devices on the network; determining, by the second device, that a result of the fuzzy matching reaches a first threshold; and in response to determining that the result of the fuzzy matching reaches the first threshold, initiating a detailed instrumentation at the second device. The method can further include determining, by the second device, that a first condition is satisfied; and in response to determining that the first condition is satisfied: generating a second malware behavior package including information from the detailed instrumentation; and communicating the second malware behavior package over the network.