Malware Sample Storage via SHA256 Hash Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting and storing malicious malware samples are unscalable and lack efficient classification, leading to difficulties in real-time identification and separation from cleanware, especially in cloud computing environments where timely responses are critical.
Innovation Solution
A method for automatically collecting, parsing, and storing malware and cleanware samples using a computerized data processing unit, converting original hashes to SHA256 hashes for unified storage, enabling efficient search and access through a metadata database and sample storage system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If known malware samples are used to test systems and raise alerts, then malware detection capability is improved, but system scalability deteriorates due to the unscalable nature of signature determination methods
Solution Approach 1:
The patent changes the parameter of hash function output format by converting various original hash types (MD5, SHA1, etc.) to a unified SHA256 format. This parameter transformation enables scalable storage and retrieval of malware samples while maintaining detection accuracy, resolving the contradiction between reliable detection and system scalability.
2Speed
If real-time malware analysis is implemented in cloud computing environments, then response timeliness is improved, but system complexity increases due to the need for efficient classification and storage mechanisms
Solution Approach 1:
The patent applies preliminary action by pre-converting all malware sample hashes to SHA256 format during the ingestion phase, and pre-organizing samples in a unified storage structure. This preliminary processing eliminates the need for complex real-time classification mechanisms, enabling fast response times while keeping the analysis system relatively simple.
Solution Approach 2:
The unified SHA256-based storage system serves multiple functions: it acts as both the identification key for malware samples and the filename for storage organization. This multi-functionality reduces system complexity by eliminating the need for separate indexing and retrieval mechanisms while maintaining real-time response capability.
3Adaptability or versatility
If multiple hash types are supported for malware samples, then compatibility with various sources is improved, but data management complexity increases due to the need for hash conversion and mapping
Solution Approach 1:
The patent extracts the hash conversion and mapping logic into a separate, dedicated component that operates independently from the main malware analysis system. This extracted module handles all hash type conversions to SHA256, allowing the core system to work with a single unified format while maintaining compatibility with multiple source formats, thereby reducing overall data management complexity.
Data Source
AI summary
The present invention relates to a method for automatically storing malicious samples, comprising collecting input samples from sample providers relating to malwares and goodwares, parsing each of the input samples to extract metadata relating to each of said input sample, adding the metadata relating to each of said input sample in a metadata database, storing each of the input sample in a sample storage, wherein the adding comprises converting the original hashes of each of the input samples to SHA256 hashes according to a hash mapping table operatively connected to the metadata database, and wherein the storing comprises defining the filename of each of the input samples equal to the corresponding SHA256 hash.