Malware Signature Generation Library Function Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware signature generation techniques often result in false positives, incorrectly identifying goodware as malware due to the inclusion of byte sequences representative of library functions, which are common to both malware and goodware.
Innovation Solution
The system disassembles malware programs, identifies byte sequences likely representative of library functions, and prevents these sequences from being included in automatically generated malware signatures, using criteria such as matching library signatures, function calls, address space proximity, and global variable access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automatic malware signature generation is used to improve productivity in malware detection, then the number of malware signatures can be increased and detection coverage improved, but false positives increase because library function byte sequences are included in signatures
Solution Approach 1:
The patent extracts and removes byte sequences representing library functions from the malware program before generating malware signatures. This is achieved by disassembling the malware, identifying library function byte sequences through comparison with known library signatures, and excluding these extracted sequences from the final signature generation process, thereby reducing false positives while maintaining detection capability
2Measurement precision
If library function byte sequences are included in malware signatures to maintain comprehensive coverage, then detection capability is improved, but goodware programs are incorrectly identified as malware
Solution Approach 1:
The patent specifically extracts byte sequences that represent library functions from the malware program. By comparing disassembled malware code against known library signatures and identifying matching byte sequences, the system removes these common library sequences from signature generation, preventing them from causing false positives in goodware detection
Solution Approach 2:
The patent applies different treatment to different parts of the malware program. Library function byte sequences are identified and excluded, while non-library byte sequences are retained for signature generation. This local differentiation ensures that only the harmful, malware-specific byte sequences are used in signatures, not the benign library portions
Data Source
AI summary
A computer-implemented method for facilitating automatic malware signature generation may comprise disassembling a malware program, identifying one or more byte sequences within the disassembled malware program that have a likelihood of being representative of one or more library functions contained within the malware program, and preventing the one or more byte sequences from being included within one or more malware signatures. Corresponding systems and computer-readable storage media are also disclosed.