Malware Detection via Structural Code Pattern Descriptors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems rely on signature- or checksum-based methods that are vulnerable to evasion by minor modifications, as malware authors reuse proven code patterns and obfuscation methods, leading to ineffective detection of new variants.
Innovation Solution
The use of Structural Code Pattern Descriptors (SCPDs) in a tree-based database that focuses on the logical structure and algorithmic operations of code, allowing proactive detection of known malware families, generic detection of obfuscation methods, and adaptive updating of detection databases to improve detection rates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature- or checksum-based detection methods are used, then detection of known malware is achieved, but detection of new malware variants is ineffective due to evasion by minor modifications
Solution Approach 1:
The patent segments malware detection into two complementary approaches: signature-based detection for known patterns and structural analysis for unknown variants. The system divides the detection database into signature databases and structural pattern databases, allowing simultaneous operation of both methods to overcome the limitation of each individual approach
Solution Approach 2:
The system dynamically adapts its detection strategy by updating structural pattern databases with newly discovered malware variants. The structural analysis component learns from new variants and updates its models, enabling the system to evolve its detection capabilities over time rather than relying on static signatures
2Adaptability or versatility
If structural code pattern descriptors are used to detect new malware variants, then detection capability improves, but system complexity increases
Solution Approach 1:
The structural analysis engine serves multiple functions: it detects unknown malware variants, analyzes obfuscation methods, and updates the detection database. This multi-functional approach consolidates what could be separate systems into a unified platform, managing complexity through functional integration rather than proliferation of separate components
Solution Approach 2:
The patent introduces an intermediary layer that translates complex structural analysis into standardized pattern descriptors. This intermediary component (the structural pattern database) acts as a mediator between the raw code analysis and the detection decision, simplifying the overall system architecture by creating a standardized intermediate representation
3Measurement precision
If comprehensive malware analysis is performed, then detection accuracy improves, but processing time increases
Solution Approach 1:
The system implements partial analysis by first performing quick signature matching, and only proceeding to more time-consuming structural analysis when signatures are inconclusive or when dealing with potentially new variants. This staged approach applies comprehensive analysis only when necessary, reducing average processing time while maintaining high detection accuracy
Data Source
AI summary
Various embodiments include an apparatus comprising a detection database including a tree structure of descriptor parts including one or more root nodes and one or more child nodes linked to from one or more parent descriptor parts chains, each of the root nodes representing a descriptor part, and each root node linked to at least one of the child nodes, each root node and each child node linked to any possible additional child nodes, wherein the possible additional child nodes include any possible successor child nodes and a descriptor comparator coupled to the detection database, the descriptor comparator operable to receive data including a plurality of logic entities, once or successively, and to continuously compare logic entities provided to the tree structure of descriptor parts stored in detection database, and to provide an output based on the comparison.