Malware Scanner Using File Chunking and Information Gain
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional static analysis tools for malware detection often fail to identify malicious code inserted strategically in binary files, as they only analyze fixed portions of the file.
Innovation Solution
A system and method that involves breaking down downloaded files into chunks, using information gain to select relevant chunks, scanning these chunks for malicious content, and predicting the maliciousness of the file based on the scan results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional static analysis tools analyze fixed portions of binary files, then the scanning process is simple and fast, but malicious code strategically inserted in unanalyzed locations cannot be detected
Solution Approach 1:
The binary file is divided into multiple overlapping chunks, where each chunk is analyzed separately. This segmentation allows the system to cover the entire file including strategically placed malicious code, while maintaining manageable analysis complexity through localized processing of each segment.
Solution Approach 2:
The analysis approach transitions from fixed positional analysis to a multi-dimensional sliding window approach, where chunks overlap and move through the file. This dimensional change ensures comprehensive coverage of all potential malware locations while maintaining systematic processing.
2Reliability
If the entire downloaded file is scanned, then all malicious code can be detected, but the scanning time and computational resources increase significantly
Solution Approach 1:
Instead of analyzing the entire file, the system analyzes multiple overlapping chunks that collectively cover the file. This partial action approach achieves complete detection coverage through strategic chunk selection and overlap, reducing total analysis time while maintaining detection completeness.
Solution Approach 2:
The file is pre-divided into chunks with predetermined overlap before scanning begins. This preliminary structuring enables efficient parallel processing and reduces computational overhead during the actual scanning phase, decreasing overall scanning time while ensuring complete coverage.
3Measurement precision
If more chunks are selected for scanning, then the accuracy of malware prediction improves, but the computational complexity and processing time increase
Solution Approach 1:
The chunk selection process is dynamic rather than static, adjusting the number and positioning of chunks based on file characteristics and detected patterns. This dynamic approach optimizes the balance between detection accuracy and processing efficiency for each specific file being analyzed.
Solution Approach 2:
The system uses feedback from initial chunk analyses to adjust subsequent scanning strategies. Results from scanned chunks inform decisions about which additional chunks to analyze, creating an adaptive process that maintains high accuracy while minimizing unnecessary computational work.
Data Source
AI summary
Systems and methods for malware filtering are provided herein. In some embodiments, a system having one or more processors is configured to: retrieve a file downloaded to a user device; break the downloaded file into a plurality of chunks; scan the plurality of chunks to identify potentially malicious chunks; predict whether the downloaded file is malicious based on the scan of the plurality of chunks; and determine whether the downloaded file is malicious based on the prediction.