Malware Detection via File Genetic Map Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods using signatures are inaccurate due to variations in signature generation and fail to detect mutated malware, leading to potential damage across various societal fields.
Innovation Solution
A malware detection system and method that extracts static information from files to create a genetic map, which is compared with stored malware genetic maps to determine similarity and detect malware, ensuring high accuracy and detection of multiple mutations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a signature is derived from a specific portion of the file, then the detection process can be simplified, but the detection accuracy deteriorates when code positions are shifted due to insertions
Solution Approach 1:
The patent segments the file into multiple predetermined items (e.g., header, sections, resources) and extracts static information from each segment independently. This allows the system to maintain detection accuracy even when code positions shift, as each segment can be evaluated separately without requiring exact position matching.
Solution Approach 2:
The patent changes the parameter used for comparison from exact signature matching to similarity ratio calculation. By computing the ratio of matching predetermined items between the target file and malware reference, the system can tolerate position variations and detect malware even when code insertion shifts positions.
2Device complexity
If only signature comparison is used, then the detection process remains simple, but the ability to detect mutated malware deteriorates
Solution Approach 1:
The patent adds a new dimension to the detection process by introducing 'static information extraction' and 'similarity ratio calculation' as additional layers beyond simple signature comparison. This multi-dimensional approach (signature + structural information + similarity ratio) enables detection of mutated malware while maintaining reasonable system complexity.
Solution Approach 2:
The patent creates a universal detection framework that can handle multiple types of malware including mutated variants. By using predetermined items that represent fundamental file structures and computing similarity ratios, the system can detect both exact matches and mutations of malware, making the detection method universally applicable to various malware types.
3Adaptability or versatility
If signature derivation position is not standardized, then adaptation to different files is easier, but detection consistency deteriorates
Solution Approach 1:
The patent applies local quality by extracting static information from specific predetermined items within the file (such as header, sections, resources) rather than treating the entire file uniformly. This allows the system to adapt to different file formats while maintaining consistent detection criteria for each local component, ensuring detection consistency across varied files.
Data Source
AI summary
A method for detecting whether a file includes malware is performed on a device. The method includes extracting information of at least two predetermined items in the file; creating a genetic map for the file by altering the extracted information into a previously set format; comparing the created genetic map with a previously stored malware genetic map to obtain a similarity between the created genetic map and the previously stored malware genetic map; and determining that the file is a malware when the similarity is higher than a reference value.