Malware Detection via Sibling File Reputation Aggregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current reputation-based security systems face challenges in detecting malware due to the proliferation of unique variants of malicious files, leading to tradeoffs between false negatives and false positives.
Innovation Solution
The system imputes reputations of known files to unknown files created within the same file paths and time period, generating a reputation rating based on the aggregated reputations of additional files, to improve malware detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If reputation-based security systems evaluate files in isolation, then individual file assessment is straightforward, but malware detection accuracy deteriorates due to unique variants evading detection
Solution Approach 1:
The patent combines reputation evaluations of multiple files created within the same file path and time period to assess the trustworthiness of a target file. Instead of evaluating files in isolation, the system aggregates reputation data from sibling files (files created together in the same location), thereby improving detection accuracy for unique malware variants that would otherwise evade traditional signature-based detection.
2Reliability
If reputation-based systems use strict evaluation criteria, then false positives increase, but false negatives decrease
Solution Approach 1:
The system uses feedback from the reputations of sibling files to adjust the evaluation of the target file. By aggregating reputation signals from files created in the same context (same path and time period), the system creates a collective assessment mechanism that reduces both false positives and false negatives, improving overall reliability without sacrificing detection precision.
3Measurement precision
If traditional digital signature detection is used, then known malware is detected reliably, but unique malware variants are missed
Solution Approach 1:
The patent transitions from one-dimensional file evaluation (assessing a single file in isolation) to multi-dimensional evaluation by incorporating contextual information from sibling files. This dimensional expansion allows the system to detect unique malware variants by analyzing their creation context and associated files, rather than relying solely on traditional digital signature matching of the target file itself.
Data Source
AI summary
A computer-implemented method for identifying potential malware may include (1) identifying a file that is subject to a reputation evaluation, (2) identifying at least one client submission received from at least one computing system that identifies (a) an instance of the file created on the computing system and (b) at least one additional file created on the computing system at substantially the same time as the instance of the file and within the same file path as the instance of the file, (3) identifying a reputation associated with the additional file(s), and then (4) generating a reputation rating for the file based at least in part on the reputation associated with the additional file(s). Various other methods, systems, and computer-readable media are also disclosed.