Malware Detection via Multi-View Obfuscation Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security software is inadequate in detecting new variants of malware that employ complex obfuscation techniques, such as polymorphic code and SPAM messages, which can evade detection by rendering each piece of malware unique and avoiding recognition by anti-virus solutions.
Innovation Solution
A method that generates multiple transformed views of an object by applying filters associated with different obfuscation types, analyzing these views and their filtered information sets to identify patterns and correlations, thereby detecting suspect correlations that indicate malicious attributes, including polymorphic code and SPAM messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If security software uses traditional single-view scanning methods, then the detection process is simple and fast, but it cannot accurately detect malware with complex obfuscation techniques
Solution Approach 1:
The patent applies segmentation by dividing the malware detection process into multiple independent filtering stages, where each filter processes a specific view of the object (e.g., original view, transformed view, filtered view). This allows the system to analyze different aspects of potentially malicious objects separately and comprehensively, improving detection accuracy for obfuscated malware while maintaining manageable system complexity through modular filter design.
Solution Approach 2:
The patent implements dimensionality change by transforming objects into multiple different views (spatial dimensions of analysis) rather than examining only the original single view. Filters are applied to different transformed views of the same object, enabling detection of malware that may be hidden in specific transformations or views, thereby significantly improving detection precision without requiring a complete redesign of the scanning architecture.
2Measurement precision
If security software analyzes multiple transformed views of objects with multiple filters, then malware detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The patent applies preliminary action by performing transformations and applying filters to multiple views of objects in advance, before final malware determination. The system pre-processes objects through various transformations and filters, storing intermediate results that can be efficiently evaluated later. This reduces real-time processing delays while maintaining high detection accuracy for obfuscated malware.
Solution Approach 2:
The patent implements partial action by allowing the system to apply only necessary filters to specific views based on detection needs, rather than uniformly processing all possible views for every object. The system can selectively apply filtering to relevant transformed views, reducing unnecessary computational overhead while maintaining sufficient detection precision for the analyzed malware variants.
3Reliability
If security software uses simple filtering methods, then processing speed is maintained, but it cannot identify complex obfuscation patterns and polymorphic code
Solution Approach 1:
The patent applies universality by designing filters that can operate on multiple types of transformed views and handle various obfuscation techniques through a unified framework. The same filtering mechanism can process different object representations (original, transformed, filtered views) and detect multiple types of malware obfuscation (polymorphic code, SPAM messages, NUL byte exploitation), reducing the need for separate specialized detection systems while improving reliability across diverse malware variants.
Data Source
AI summary
A method in one example implementation includes generating a plurality of transformed views of an object in a network environment and generating a plurality of filtered information sets. The method further includes detecting a suspect correlation based on an analysis of at least some of the plurality of transformed views and of at least some of the plurality of filtered information sets. In a more specific embodiment, the analysis includes an original view of the object. Other more specific embodiments include applying filters to selected views of the object, where each of the filters is associated with a different obfuscation type. Applying the filters includes transforming obfuscation elements in the plurality of transformed views, where the object contains the one or more obfuscation elements.