Malware Detection via File Property Risk Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to detect malicious files until they are loaded into memory, and many require continuous updates to recognize new malware, leading to delayed detection and inefficiencies.
Innovation Solution
A method that analyzes files for predefined properties such as section names, import function counts, and thread local storage to calculate a risk score, allowing for early detection of malicious files before execution, without the need for periodic updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If prior systems load files into memory to detect malicious software, then detection capability is achieved, but detection timing is delayed until after loading
Solution Approach 1:
The system performs preliminary analysis of file properties (section names, import functions, thread local storage characteristics) before the file is loaded into memory or executed. This preliminary action enables detection to occur at an earlier stage, preventing malicious files from being loaded while maintaining reliable detection through multiple property verification
2Measurement precision
If prior systems use signature-based detection methods, then accurate malware recognition is achieved, but continuous updates are required to recognize new malware
Solution Approach 1:
The system transitions from signature-based detection to property-based analysis, examining multiple parameters including section name characteristics, import function counts, and thread local storage properties. This parameter-based approach enables the system to adapt to new malware variants by analyzing structural properties rather than relying on predefined signatures, maintaining both accuracy and versatility
3Productivity
If prior systems analyze files after loading into memory, then comprehensive analysis is possible, but security response is delayed
Solution Approach 1:
The system performs preliminary analysis of file properties before memory loading, examining section names, import functions, and thread local storage characteristics in advance. This enables both comprehensive property verification and rapid security response, as the analysis occurs during file reception rather than after loading
Data Source
AI summary
A method suitable for detecting malicious files includes several steps. A file that is received into a computer system is analyzed to determine a presence or absence of each of a plurality of predefined properties in the file. A score is calculated based on the presence or absence of the plurality of properties in the file. This score is reflective of the risk that the file is malicious. Once the score is calculated, the file can be further processed based on the score.