Signature Extraction from Malware Samples to Reduce Bandwidth
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for generating signatures for identifying unwanted data, such as malware, result in excessive bandwidth and resource consumption due to the need for full samples of potentially unwanted data.
Innovation Solution
A system and method that extracts information from a portion of a potentially unwanted data sample to generate a signature, reducing the need to send the entire sample by using rules to determine the portion and extract relevant information, which is then processed to create a detection record.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If full samples of potentially unwanted data are sent to generate signatures, then signature accuracy is improved, but bandwidth consumption increases
Solution Approach 1:
The patent extracts only the necessary signature information from potentially unwanted data samples rather than transmitting full samples. The system identifies and extracts specific characteristics, patterns, or features from the data that are sufficient for generating accurate signatures, thereby reducing bandwidth consumption while maintaining signature accuracy.
Solution Approach 2:
The patent segments the data transmission process into two parts: local analysis of full data samples to extract signature information, and transmission of only the extracted signature data rather than complete samples. This segmentation allows the system to maintain high signature accuracy while significantly reducing network bandwidth requirements.
2Manufacturing precision
If full samples of potentially unwanted data are processed, then signature quality is improved, but resource consumption increases
Solution Approach 1:
The system extracts only the essential signature characteristics from full data samples during local processing, rather than transmitting and reprocessing complete samples at remote systems. This extraction approach maintains signature quality by preserving critical identifying features while reducing the computational resources required for signature generation.
Solution Approach 2:
The patent performs preliminary analysis and signature extraction at the local system before transmission. By pre-processing the data locally to extract only the necessary signature information, the system reduces the computational burden on remote systems while maintaining high signature quality for detection purposes.
3Loss of energy
If information is extracted from a portion of the data sample, then bandwidth consumption is reduced, but information completeness may be compromised
Solution Approach 1:
The patent applies local quality by extracting specific, targeted information from particular portions of data samples that are most relevant for signature generation. Rather than transmitting complete samples or uniformly sampling all data, the system identifies and extracts only the locally relevant characteristics needed for accurate signature creation, maintaining information completeness for detection purposes while minimizing bandwidth usage.
Data Source
AI summary
A system, method and computer program product are provided for sending information extracted from a potentially unwanted data sample to generate a signature. In use, information is extracted from a portion of a sample of potentially unwanted data. Further, the information is sent to generate a signature.