Malware Detection via Source Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antimalware technologies face challenges in detecting new malware variants and identifying their association with known malware families, especially when they use polymorphic packers and evasion techniques, leading to false positives and failure in traditional signature-based detection.
Innovation Solution
The use of clustering with malware source information, including IP, hostname, domain, and BGP data, to generate graphs and identify associations between malware samples and their sources, enabling detection of malware families and zero-day threats without relying solely on signature-based methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection methods are used, then known malware can be identified, but new malware variants and zero-day threats cannot be detected
Solution Approach 1:
The system performs preliminary clustering of malware samples based on source information (IP addresses, hostnames, domains) before final detection. This preliminary grouping allows the system to identify patterns and associations among malware samples, enabling detection of new variants and zero-day threats by recognizing their clustering with known malware families, rather than relying solely on pre-existing signatures.
Solution Approach 2:
The patent introduces an intermediary clustering mechanism that mediates between raw malware samples and detection decisions. By clustering samples based on source information and using this cluster data to generate detection rules, the system creates an intermediate layer that translates observed malware behavior into actionable detection capabilities, bridging the gap between known malware identification and detection of unknown threats.
2Adaptability or versatility
If clustering with malware source information is used, then new malware variants and zero-day threats can be detected, but system complexity increases
Solution Approach 1:
The system segments the detection process into distinct modules: source information extraction, clustering algorithm execution, and rule generation. By dividing the complex detection task into these manageable segments, the patent reduces overall system complexity while maintaining the capability to detect new malware variants. Each segment can be independently optimized and maintained.
Solution Approach 2:
The clustering mechanism serves multiple functions simultaneously: it groups malware samples, identifies source associations, generates detection rules, and enables both known malware identification and zero-day threat detection. This multi-functionality reduces the need for separate detection systems, thereby reducing overall complexity while enhancing detection versatility.
3Reliability
If traditional antimalware technologies are used, then false positives occur, but the system lacks ability to identify malware family associations
Solution Approach 1:
The system implements feedback loops where detected malware samples and their source information are fed back into the clustering system. This feedback enables continuous refinement of cluster assignments and detection rules, improving accuracy over time while preserving malware family association information. The feedback mechanism allows the system to learn from each detection and adjust its understanding of malware relationships.
Solution Approach 2:
The patent changes the detection parameters from traditional signature matching to clustering-based source information analysis. By using parameters such as IP address patterns, hostname similarities, and domain relationships instead of fixed signatures, the system maintains high detection accuracy while capturing malware family associations that traditional methods miss.
Data Source
AI summary
Techniques for malware detection using clustering with malware source information are disclosed. In some embodiments, malware detection using clustering with malware source information includes generating a first cluster of source information associated with a first malware sample, in which the first malware sample was determined to be malware, and the first malware sample was determined to be downloaded from a first source; and determining that a second source is associated with malware based on the first cluster.