Malware Detection Graph Traversal for Constant-Time Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods are inefficient due to the need for time-consuming token-by-token comparison of data streams with numerous malware signatures, leading to slow detection and identification of malware variants.
Innovation Solution
A method involving the creation of a signature graph that links malware signatures using a preamble table and logic splices, allowing for rapid identification of malware by traversing the graph during runtime processing, independent of the number of patterns searched.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional token-by-token comparison methods are used to detect malware, then malware detection can be performed, but the detection process is time-consuming and inefficient
Solution Approach 1:
The patent preprocesses malware signatures during an offline phase to build a compressed graph structure that captures all possible malware patterns. This preliminary action transforms the raw signature data into an optimized format that enables constant-time detection during runtime, eliminating the need for time-consuming token-by-token comparisons while maintaining reliable malware detection capability.
Solution Approach 2:
The patent creates a compressed graph copy of the malware signature database that preserves the essential pattern-matching information in a more efficient structure. Instead of storing and comparing against the full token sequences during runtime, the system uses this compressed graph representation to achieve rapid pattern recognition and malware identification.
2Adaptability or versatility
If multiple malware signatures are stored in a database for comprehensive detection, then detection coverage is improved, but the complexity of processing and comparing signatures increases
Solution Approach 1:
The patent merges multiple malware signatures into a unified compressed graph structure where overlapping patterns are consolidated into shared paths and nodes. This merging process reduces the overall complexity by eliminating redundant comparisons while maintaining comprehensive detection coverage across multiple malware variants.
Solution Approach 2:
The patent segments the signature database into a hierarchical graph structure with preambles, bodies, and logic splices that organize the complexity in a manageable way. This segmentation allows the system to process signatures efficiently by navigating through structured segments rather than handling raw signature data, reducing processing complexity while maintaining versatility.
3Measurement precision
If traditional signature comparison methods are used, then malware identification can be performed, but the process requires writing data streams to memory for sequential examination
Solution Approach 1:
The patent replaces the mechanical sequential comparison process with a graph-traversal-based system that can evaluate multiple patterns simultaneously. Instead of writing data to memory and examining tokens sequentially, the system uses the compressed graph structure to enable parallel pattern matching and constant-time detection, dramatically improving detection throughput while maintaining identification accuracy.
Data Source
AI summary
An arrangement analyzes a data stream to identify particular token sequences known to be of interest or malware. A preprocessing step organizes the malware tokens into a “graph” in which overlapping token sequences are interconnected with logic splices. The preprocessing is performed only once for a given set of malware targets. The resulting graph can be traversed quickly in runtime operation to identify malware token strings in the data stream.