Malware Detection via Metadata Statistical Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying malware in electronic documents rely on pattern matching, which often results in false positives and false negatives due to focusing solely on data, missing embedded malware in metadata.
Innovation Solution
A statistical approach that analyzes metadata structures in electronic documents using pre-established rules to generate a numerical score, comparing it to a model threshold value to determine the likelihood of embedded malware, minimizing false positives and negatives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If pattern matching is used to search for predefined byte sequences in document data, then documents with obvious malicious content can be identified, but malware embedded in metadata is missed and false positives occur
Solution Approach 1:
The patent segments the document analysis into two distinct parts: analyzing the visible data content using pattern matching, and analyzing the hidden metadata separately using statistical modeling. This segmentation allows each method to focus on its strengths without interfering with the other, thereby improving overall detection accuracy while reducing false positives from metadata anomalies
Solution Approach 2:
The patent introduces statistical modeling as an intermediary layer between the raw metadata and the detection decision. Instead of directly applying pattern matching to metadata, the system uses statistical models to interpret metadata patterns, which acts as a mediator that reduces false positives while maintaining detection of actual malware
2Productivity
If pattern matching focuses only on document data, then processing is simple and fast, but malware hidden in metadata is completely missed
Solution Approach 1:
The patent divides the detection system into two parallel segments: one processing data content for speed, and another processing metadata for completeness. Both segments operate independently and contribute to the final detection decision, ensuring neither speed nor completeness is compromised
Solution Approach 2:
The patent merges the results from data-based pattern matching and metadata-based statistical modeling into a unified detection decision. This combination ensures that malware detected by either method will be identified, achieving both speed and completeness in malware detection
3Measurement precision
If metadata is analyzed using statistical modeling, then malware embedded in metadata is detected, but the system complexity increases
Solution Approach 1:
The patent uses statistical models as intermediaries that automatically process metadata without requiring complex manual analysis rules. These models serve as ready-made analytical tools that reduce system complexity while maintaining high detection precision for metadata-based malware
4Extent of automation
If pre-established rules are applied to metadata structures, then automated scoring is achieved, but the initial model development requires significant effort
Solution Approach 1:
The patent performs preliminary action by pre-establishing statistical models and rules during an offline phase using training data. This preliminary work automates the detection process for future documents, requiring significant effort only once during model development rather than for each individual document analysis
Data Source
AI summary
The present invention provides a method for determining the likelihood that an electronic document contains embedded malware. After parsing or sequencing an electronic document, the metadata structures that make up the document are analyzed. A number of pre-established rules are then applied with respect to certain metadata structures that are indicative of embedded malware. The application of these rules results in the generation of a score for the electronic document being tested for embedded malware. The score is then compared to a threshold value, where the threshold value was previously generated based on a statistical model relating to electronic documents having the same format as the document being tested. The result of the comparison can then be used to determine whether the document being tested is or is not likely to contain embedded malware.