Malware Detection via Distinctive Signature Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-virus software is vulnerable to zero-day attacks and lacks the computational resources to effectively detect and eliminate malware already installed on individual network machines, especially those not originating from the network or identified prior to detection.
Innovation Solution
A system that analyzes network traffic to identify suspected malware, derives a distinctive signature, and scans computing devices to detect and eliminate zero-day malware, using a combination of network monitoring, threat analysis, and fingerprinting algorithms to identify and remove malware from both network traffic and installed files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If advanced code analysis algorithms are used to detect zero-day malware, then detection capability is improved, but computational resource requirements increase making regular operation infeasible
Solution Approach 1:
The system segments the malware detection task by separating signature generation from signature matching. Advanced code analysis is performed once on suspicious files to generate distinctive signatures, which are then distributed to multiple endpoints for efficient matching against local files. This divides the computationally intensive analysis from the resource-constrained detection operations.
Solution Approach 2:
The system performs preliminary code analysis and signature generation in advance before distribution to endpoints. By pre-processing suspicious files to extract distinctive signatures and distributing them proactively to network machines, the system enables resource-efficient local detection without requiring each endpoint to perform complex analysis in real-time.
2Use of energy by moving object
If signature-based detection is used, then computational resources are conserved, but detection capability against zero-day malware is lost
Solution Approach 1:
The system creates copies of distinctive signatures extracted from analyzed malware and distributes them to multiple endpoints. Each endpoint receives a copy of the signature database and performs efficient signature matching against local files, enabling resource-efficient detection without requiring each machine to perform complex analysis.
Solution Approach 2:
The system introduces distinctive signatures as an intermediary between the complex code analysis performed on suspicious files and the resource-constrained detection operations at endpoints. The signatures serve as a simplified representation that bridges the gap between advanced analysis capability and efficient local detection resources.
3Reliability
If network traffic analysis is performed, then malware traversing the network is detected, but malware already installed on devices from non-network sources remains undetected
Solution Approach 1:
The system makes the detection mechanism universal by distributing distinctive signatures to all endpoints in the network. Each endpoint can then detect malware locally regardless of how it was installed (network or non-network sources), making the detection capability adaptable to all malware installation vectors rather than being limited to network traffic analysis.
Data Source
AI summary
A method of detecting malware is provided. The method includes (a) from a database of historic network traffic, identifying a suspect file that traveled through a network as being suspected malware, (b) deriving a distinctive signature based on contents of the suspect file, and (c) scanning a computerized device of the network for the distinctive signature to detect whether the suspect file is present on the computerized device. Embodiments directed to analogous computer program products and apparatuses are also provided.