Malware Variant Detection via Class File Metadata Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional anti-malware techniques are costly and ineffective on mobile platforms due to their reliance on static-string-based detection mechanisms, which can be easily circumvented by malware authors, necessitating a more efficient method for detecting malware variants.
Innovation Solution
A system and method that compares metadata fields within suspect application package files with those of known malware families to determine similarity, using metadata such as class file sizes, method lengths, and functionality requirements, to identify threat variants within the same threat family.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional static-string-based detection mechanisms are used, then malware detection can be performed, but the detection is costly and ineffective on mobile platforms
Solution Approach 1:
The patent extracts and compares only the metadata fields from class files rather than analyzing entire application packages or using comprehensive static-string-based detection. This extraction approach reduces the detection workload and cost while maintaining effectiveness in identifying malware variants through metadata similarity comparison.
Solution Approach 2:
The patent changes the detection parameter from static strings and byte code sequences to metadata fields such as class file sizes, method lengths, and functionality requirements. This parameter transformation enables more effective detection of malware variants that have been obfuscated through string and code sequence modification.
2Reliability
If static-string-based detection mechanisms are used, then malware can be detected, but malware authors can easily circumvent detection by modifying their malware
Solution Approach 1:
The patent transforms the detection approach by changing from static string matching to metadata field comparison. Metadata fields such as class file sizes, method lengths, and functionality requirements remain consistent even when malware authors modify strings and code sequences, thereby maintaining detection accuracy against evolved malware variants.
Solution Approach 2:
The patent performs preliminary extraction and analysis of metadata fields from class files before comparison. By preparing and storing metadata characteristics in advance, the system can quickly compare new applications against known malware families, enabling reliable detection of variants before they can cause harm.
3Reliability
If comprehensive analysis of application packages is performed, then accurate malware detection can be achieved, but the detection process becomes too costly for mobile platforms
Solution Approach 1:
The patent extracts only the essential metadata fields from class files, such as class file sizes, method lengths, and functionality requirements, rather than performing comprehensive analysis of entire application packages. This selective extraction significantly reduces detection cost and computational overhead while maintaining sufficient accuracy for malware identification.
Solution Approach 2:
The patent applies partial action by analyzing only the critical metadata fields necessary for malware detection rather than performing exhaustive analysis of all application package components. This partial analysis approach achieves effective malware detection at a fraction of the cost of comprehensive scanning.
Data Source
AI summary
A computer-implemented method for detecting malware variants may include (1) identifying an application package file including at least one class file, (2) identifying a set of metadata fields within the class file, (3) comparing the set of metadata fields within the class file with a set of metadata fields within a corresponding class file found in a known malware package to determine a similarity between the application package file and the known malware package, and (4) determining, based on the similarity between the application package file and the known malware package, that the application package file is a threat variant in a same threat family as the known malware package. Various other methods, systems, and computer-readable media are also disclosed.