Malware Detection via Fuzzy Hash Remote Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods fail to effectively determine whether a client device is infected by a malicious file, especially when the file does not execute on all devices, leading to potential undetected infections and delayed remediation.

Innovation Solution

A security device generates file identification information using fuzzy hashes from execution results in a testing environment and obtains remote access to client devices to determine infection status, prioritizing remediation based on matching fuzzy hashes with running processes and registry keys.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional detection methods are used to identify malicious files, then the detection process is simple, but the detection accuracy is low and infections are missed

Engineering Contradiction:

Improvedetection accuracyVSAvoiddetection process complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent introduces fuzzy hash values as an intermediary mechanism to bridge the gap between simple detection methods and accurate infection identification. Instead of directly comparing malicious files, the system generates fuzzy hash values from execution results (processes, registry keys, files) and uses these as mediators to match infected devices with known malware patterns, thereby improving detection accuracy while maintaining operational simplicity

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent creates copies of execution results in the form of fuzzy hash values. Rather than analyzing actual malicious files or processes directly, the system generates hash representations of execution artifacts (processes, registry keys, files) and compares these copies against known malware patterns. This copying approach enables accurate detection without requiring direct access to or analysis of the actual malicious code

Inventive Principle:

Principle #26Copying

2Reliability

If the system scans all client devices for malware, then all infections are detected, but the time and resources required increase significantly

Engineering Contradiction:

Improveinfection detection completenessVSAvoiddetection time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent performs preliminary actions by generating fuzzy hash values from execution results in advance and storing them for comparison. Instead of conducting full malware scans when detection is needed, the system has already prepared hash representations of execution artifacts (processes, registry keys, files) that can be quickly matched against known malware patterns. This preliminary hashing enables rapid detection without requiring time-consuming full scans of all client devices

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces the mechanical process of traditional malware scanning with a computational hash-based comparison system. Instead of mechanically scanning and analyzing malicious code on each device, the system uses fuzzy hash algorithms to transform execution results into comparable representations, then uses efficient hash matching to identify infections. This substitution of mechanical scanning with computational hashing dramatically reduces detection time and resource requirements

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Measurement precision

If the system uses exact hash matching to identify malicious files, then the identification is precise, but it fails to detect permuted or modified versions of malware

Engineering Contradiction:

Improvemalware identification precisionVSAvoiddetection coverage across malware variants

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent changes the parameter of hash matching from exact matching to fuzzy matching. Instead of requiring identical hash values, the system uses fuzzy hash algorithms that allow for variations and permutations in the hash values while still identifying the same malware family. This parameter change enables the system to maintain precision in identifying malicious patterns while becoming adaptable to detect modified or permuted versions of malware that would fail exact matching

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS9953164B2Confirming a malware infection on a client device using a remote access connection tool, to identify a malicious file based on fuzz hashes

Publication Date: 2018.04.24 JUNIPER NETWORKS INC

AI summary

A device may receive a trigger to determine whether one or more client devices, of a set of client devices, are infected by a malicious file. The device may generate file identification information associated with the malicious file based on receiving the trigger to determine whether the one or more client devices are infected by the malicious file. The device may obtain remote access to the one or more client devices using a connection tool based on receiving the trigger to determine whether the one or more client devices are infected by the malicious file. The device may obtain information, associated with the one or more client devices, using the remote access. The device may provide information indicating whether the one or more client devices are infected by the malicious file based on the file identification information and the information associated with the one or more client devices.