Malware Sample Storage via SHA256 Hash Mapping

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for detecting and storing malicious malware samples are unscalable and lack efficient classification, leading to difficulties in real-time identification and separation from cleanware, especially in cloud computing environments where timely responses are critical.

Innovation Solution

A method for automatically collecting, parsing, and storing malware and cleanware samples using a computerized data processing unit, converting original hashes to SHA256 hashes for unified storage, enabling efficient search and access through a metadata database and sample storage system.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If known malware samples are used to test systems and raise alerts, then malware detection capability is improved, but system scalability deteriorates due to the unscalable nature of signature determination methods

Engineering Contradiction:
Improvemalware detection capabilityVSAvoidsystem scalability
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent changes the parameter of hash function output format by converting various original hash types (MD5, SHA1, etc.) to a unified SHA256 format. This parameter transformation enables scalable storage and retrieval of malware samples while maintaining detection accuracy, resolving the contradiction between reliable detection and system scalability.

Inventive Principle:
Principle #35Parameter changes

2Speed

If real-time malware analysis is implemented in cloud computing environments, then response timeliness is improved, but system complexity increases due to the need for efficient classification and storage mechanisms

Engineering Contradiction:
Improveresponse timelinessVSAvoidsystem complexity
Core Design Contradiction:
SpeedVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by pre-converting all malware sample hashes to SHA256 format during the ingestion phase, and pre-organizing samples in a unified storage structure. This preliminary processing eliminates the need for complex real-time classification mechanisms, enabling fast response times while keeping the analysis system relatively simple.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The unified SHA256-based storage system serves multiple functions: it acts as both the identification key for malware samples and the filename for storage organization. This multi-functionality reduces system complexity by eliminating the need for separate indexing and retrieval mechanisms while maintaining real-time response capability.

Inventive Principle:
Principle #6Universality (Multi-functionality)

3Adaptability or versatility

If multiple hash types are supported for malware samples, then compatibility with various sources is improved, but data management complexity increases due to the need for hash conversion and mapping

Engineering Contradiction:
Improvesource compatibilityVSAvoiddata management complexity
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent extracts the hash conversion and mapping logic into a separate, dedicated component that operates independently from the main malware analysis system. This extracted module handles all hash type conversions to SHA256, allowing the core system to work with a single unified format while maintaining compatibility with multiple source formats, thereby reducing overall data management complexity.

Inventive Principle:
Principle #2Taking out (Extraction)

Data Source

PatentUS20240202334A1Method for automatic storing of malicious samples
Publication Date: 2024.06.20 NOZOMI NETWORKS SAGL

AI summary

The present invention relates to a method for automatically storing malicious samples, comprising collecting input samples from sample providers relating to malwares and goodwares, parsing each of the input samples to extract metadata relating to each of said input sample, adding the metadata relating to each of said input sample in a metadata database, storing each of the input sample in a sample storage, wherein the adding comprises converting the original hashes of each of the input samples to SHA256 hashes according to a hash mapping table operatively connected to the metadata database, and wherein the storing comprises defining the filename of each of the input samples equal to the corresponding SHA256 hash.