Malware Detection via Sub-pattern Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods in data streams are inefficient due to the need for examining each data stream for pre-specified patterns, which can lead to high computational complexity and reduced throughput performance, especially when dealing with wildcard characters.
Innovation Solution
The solution involves identifying malware sub-patterns that occur at low frequencies in clean data streams, clustering malware signatures with identical sub-sequences, and storing this information in a multi-level hash, allowing for efficient scanning and reducing the need for extensive comparisons by using sub-sequences as keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each data stream is examined for pre-specified malware signatures, then malware detection accuracy is improved, but computational complexity increases and throughput performance decreases
Solution Approach 1:
The malware signature is divided into multiple sub-sequences, and the data stream is processed by checking these sub-sequences separately. This segmentation allows the system to quickly eliminate signatures that don't match any sub-sequence, reducing the computational burden of full signature matching while maintaining detection accuracy.
Solution Approach 2:
The patent performs partial matching by examining only sub-sequences of the malware signature rather than the entire signature. This partial action approach enables rapid filtering of non-matching signatures, with full signature verification performed only when necessary, thus improving throughput while preserving detection reliability.
2Adaptability or versatility
If wildcard characters are included in malware signatures, then detection versatility is improved, but processing efficiency deteriorates due to increased comparison requirements
Solution Approach 1:
Signatures containing wildcard characters are segmented into sub-sequences, with wildcards handled at the sub-sequence level rather than the full signature level. This allows the system to process wildcard-containing signatures more efficiently by limiting the scope of complex pattern matching to smaller segments.
Solution Approach 2:
The patent applies partial matching to wildcard-containing signatures by verifying only relevant sub-sequences. This reduces the number of comparisons required while maintaining the versatility of wildcard matching, as full signature verification is performed only when sub-sequence matching succeeds.
3Reliability
If multiple malware signatures are scanned simultaneously, then detection coverage is improved, but computational complexity increases
Solution Approach 1:
Multiple malware signatures are processed by segmenting each into sub-sequences and organizing them in a multi-level hash structure. This allows the system to simultaneously scan for multiple signatures by checking sub-sequences against the hash, reducing the computational complexity of multi-signature detection while maintaining comprehensive coverage.
Data Source
AI summary
Detecting malwares in data streams of interest. In an embodiment, for each malware signature of interest, a malware sub-pattern that is likely to occur at low frequencies in clean data streams is identified. When scanning a data stream for malwares, each portion of the data stream is examined for match with a malware sub-pattern of a malware signature. If there is no match with any portion of the data stream, it is concluded that the data stream is free of a first malware corresponding to the malware signature. If there is a match with a first portion of the data stream, the data stream is examined around the first portion for the malware signature, wherein the data stream is concluded to contain the first malware if the data stream around the first portion is found to match the malware signature.