Malware Family Classification Using Fuzzy Hashes and Sandbox Artifacts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware classification methods are slow, resource-intensive, and not always accurate, particularly in real-time detection and family classification, due to reliance on manual analysis and limited rules in sandbox environments.
Innovation Solution
The system automatically generates rules from sandbox outputs using fuzzy hashes and indicators of compromise to classify malware families in real-time, reducing processing time to less than one second by comparing fuzzy hashes and artifacts, and ignoring poor execution quality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual malware analysis and specific malware-defining rules are used, then detection accuracy can be maintained, but processing speed and productivity deteriorate
Solution Approach 1:
The system automatically generates malware family classification rules by analyzing sandbox outputs and behavioral patterns without requiring manual analysis. The rule generation process is self-service, where the system learns from observed malware behaviors and autonomously creates classification rules, eliminating the need for continuous manual rule development while maintaining high detection accuracy.
Solution Approach 2:
The patent replaces manual mechanical analysis processes with automated computational systems. Instead of analysts manually examining malware behaviors and creating rules, the system uses automated pattern recognition and machine learning algorithms to analyze sandbox outputs and generate classification rules, dramatically improving processing speed while maintaining accuracy.
2Measurement precision
If comprehensive malware analysis rules are implemented, then classification accuracy improves, but system complexity and resource consumption increase
Solution Approach 1:
The system segments the malware classification process into distinct phases: sandbox execution, behavioral pattern extraction, rule generation, and classification. Each phase handles specific tasks independently, reducing overall system complexity. The rule generation phase is further segmented into family-specific rule sets, allowing manageable complexity while achieving comprehensive classification accuracy.
3Productivity
If real-time malware classification is implemented, then productivity improves, but processing time and resource requirements worsen
Solution Approach 1:
The system performs preliminary analysis during sandbox execution, collecting behavioral patterns and artifacts as the malware runs. Rule generation is initiated in advance based on observed patterns, allowing the classification decision to be made rapidly when needed. This preliminary action enables real-time classification without excessive processing delays.
Solution Approach 2:
The system dynamically adjusts analysis parameters based on the malware being examined. For well-known malware families, the system uses pre-generated rules with faster matching parameters. For novel malware, more comprehensive analysis parameters are applied. This adaptive parameter adjustment enables real-time classification while optimizing resource usage based on the specific threat level.
Data Source
AI summary
Methods and systems utilizing sandbox outputs for files, such as dynamic file analysis (DFA) reports, regardless of size, to automatically create rules. From these rules, the maliciousness of the file is determined, and if the file is malicious, i.e., malware, the malware is classified into malware families.