Malware Signature Generation via Contiguous String Block Wildcards
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods face challenges in identifying previously unknown malware without generating excessive false positives, particularly due to rapid malware evolution and obfuscation, which slows down memory analysis from real-time to forensic levels.
Innovation Solution
The method involves generating malware signatures by searching for contiguous string blocks in known malware, ranking them, and using wildcarding techniques to create signatures that represent entire families of malware, allowing for proactive detection while maintaining a manageable number of signatures and minimizing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional malware detection methods use numerous specific signatures to identify evolving malware variants, then detection coverage improves, but false positive rates increase excessively
Solution Approach 1:
The patent segments malware identification into two levels: (1) family-level identification using wildcard patterns that match common obfuscated strings across malware families, and (2) variant-level identification using more specific patterns. This segmentation allows broad coverage at the family level without triggering false positives from overly specific signatures.
Solution Approach 2:
The patent changes the parameter of signature specificity by introducing wildcard characters (*) that allow partial matching. Instead of requiring exact string matches, the system uses parameterized patterns where wildcards represent variable portions of obfuscated strings, enabling detection across malware variants while maintaining reliability.
2Difficulty of detecting and measuring
If malware obfuscation techniques are used to hide malware signatures, then malware detection difficulty increases, but analysis time increases from real-time to forensic levels
Solution Approach 1:
The patent extracts common obfuscated strings from multiple malware samples to create wildcard patterns. By taking out the invariant portions of obfuscated malware code and representing them as searchable patterns with wildcards, the system enables real-time detection without requiring full forensic analysis of each sample.
Solution Approach 2:
The patent performs preliminary analysis by collecting and analyzing malware samples offline to generate wildcard signatures before deployment. This preliminary action creates pre-computed detection patterns that can be applied in real-time, eliminating the need for slow forensic analysis during actual detection operations.
3Measurement precision
If static file scanners attempt to keep up with rapid obfuscator changes, then detection accuracy may improve, but the task becomes daunting and resource-intensive
Solution Approach 1:
The patent creates universal wildcard signatures that can detect multiple malware variants and families simultaneously. A single wildcard pattern can match across different obfuscation techniques and malware families, reducing scanner complexity while maintaining or improving detection accuracy through multi-functional signatures.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A technique for detecting malware involved loading known malware information, finding a string in the known malware information, saving the string in a first database, identifying a first contiguous string block from the known malware information, assigning a confidence indicator to the first contiguous string block, attempting to find the first contiguous string block in a second database containing one or more contiguous string blocks extracted from known malware, and labelling the first contiguous string block, responsive to a determination the first contiguous string block meets a predetermined threshold of similarity with a second contiguous string block contained in the second database.