Malware Reputation via Common Metadata Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware technologies face challenges in identifying and managing polymorphic malware variants, as they often require separate digital signatures for each variant, and existing methods struggle to associate multiple variants with a common malicious design.
Innovation Solution
The system identifies program files with common metadata field values set by a program development tool, determines the proportion of malicious files among them, and associates a negative reputation with these metadata field values if the proportion exceeds a threshold, effectively linking related files with a common code base.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If separate digital signatures are used to identify each malware variant, then detection accuracy for individual variants is improved, but the complexity of managing and updating signatures increases significantly
Solution Approach 1:
The patent merges multiple individual malware signatures into a single family-level signature by identifying common metadata fields across variants. Instead of maintaining separate signatures for each polymorphic variant, the system combines them under a unified reputation identifier, reducing signature management complexity while preserving detection capability.
Solution Approach 2:
The patent creates a universal reputation identifier that can identify entire families of malware variants through common metadata fields. This single identifier serves multiple functions: detecting individual variants, grouping related files, and establishing family-level reputation, replacing the need for multiple variant-specific signatures.
2Reliability
If traditional signature-based detection is used for polymorphic malware, then individual variant detection may be achieved, but the ability to associate variants with a common malicious design is lost
Solution Approach 1:
The patent introduces common metadata fields as intermediary elements that link individual malware variants to their family reputation. These metadata fields serve as mediators that preserve the connection between variants and their common malicious design, enabling both individual detection and family-level association simultaneously.
Solution Approach 2:
The patent adds a new dimension to malware identification by incorporating metadata field analysis alongside traditional signature matching. This additional dimension enables the system to associate variants with common malicious designs by examining shared metadata characteristics, rather than relying solely on signature presence.
3Quantity of substance
If multiple malware variants are identified separately, then comprehensive detection coverage is improved, but additional analysis time is required to determine they share a common design
Solution Approach 1:
The patent performs preliminary extraction and comparison of metadata fields from malware variants to establish family relationships in advance. By pre-identifying common metadata characteristics and creating family-level reputation identifiers, the system reduces the time required for subsequent analysis while maintaining comprehensive detection coverage.
Data Source
AI summary
The disclosed computer-implemented method for establishing a reputation for related program files may include (1) identifying a set of related program files, where each program file includes one or more common metadata field values and the values of the metadata fields are set by a program development tool, (2) identifying one or more of the set of related program files as malicious, (3) determining that a proportion of malicious files in the set of related program files is above a threshold, and (4) in response to determining that the proportion of malicious files is above the threshold, associating a negative reputation with the metadata field values. Various other methods, systems, and computer-readable media are also disclosed.