Malware Profiling via Opcode Hashing for Variant Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity technologies struggle to detect and respond to new or variant malware, decoy information, and advanced persistent threats (APT) effectively, lacking standardized methods for describing malware and attack techniques, and failing to identify attackers accurately.
Innovation Solution
A cyber threat information processing apparatus and method that disassembles executable files to extract opcode-and-ASM code combinations, converts them into hash functions, and uses ensemble machine learning to generate malware profiling information, including similarity and attacker identification, over independent communication networks like LTE, 5G, or 6G.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional pattern-based detection methods are used, then detection speed and accuracy are improved for known malware, but detection capability deteriorates for new or variant malware
Solution Approach 1:
The system performs preliminary disassembly and hash function conversion on malware samples before analysis. By pre-processing executable files into standardized hash representations, the system creates a foundation for both rapid pattern matching (improving detection speed for known malware) and effective machine learning analysis (improving detection capability for new malware variants).
Solution Approach 2:
The patent replaces conventional pattern-matching mechanisms with ensemble machine learning models that analyze hash function representations. This substitution enables the system to detect new and variant malware by learning from training data, while maintaining fast detection capabilities through efficient hash-based comparison for known threats.
2Adaptability or versatility
If AI analysis is used to detect and analyze malware, then analysis capability is improved, but standardization and unified identification deteriorate
Solution Approach 1:
The system implements a universal hash function representation that serves multiple purposes: it enables AI/ML analysis for detecting new malware variants, supports rapid pattern matching for known threats, and provides a standardized format for malware identification and communication. This single representation method fulfills multiple functions that previously required separate systems.
Solution Approach 2:
The patent transforms diverse malware characteristics into standardized hash function parameters through disassembly and code conversion. By changing the representation parameters from raw executable code to structured hash values, the system enables both advanced AI analysis and standardized identification, resolving the contradiction between analysis capability and standardization.
3Measurement precision
If detailed disassembly and hash conversion is performed, then detection precision is improved, but processing time increases
Solution Approach 1:
The system performs disassembly and hash function conversion as preliminary actions before detailed analysis. By pre-processing executable files into hash representations, the system creates ready-to-analyze data structures that enable both high-precision detection and efficient processing, avoiding the need to perform these time-consuming operations during actual detection events.
Solution Approach 2:
The patent segments the malware analysis process into distinct stages: disassembly, hash function conversion, and analysis. By dividing the processing into segments, the system can perform detailed disassembly and conversion once to create reusable hash representations, then use these pre-processed segments for rapid detection without repeating the time-consuming disassembly operations.
Data Source
AI summary
A cyber threat information processing method, a cyber threat information processing processor, and a storage medium storing a program for processing cyber threat information may process an executable file to ensure characteristic information of the executable file, transmit the ensured characteristic information of the executable file over an independent network, and receive malware profiling information generated based on the characteristic information of the executable file over the independent network.