Malware Detection via Common Substring Decision Trees
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional malware detection methods rely on known signatures and struggle to identify unknown malware, leading to exposure to new threats and increased computational burdens, while behavior monitoring requires significant resources and may not detect all malware variants effectively.
Innovation Solution
A technique using global monitoring and common substring identification, leveraging collaborative intelligence and probability distributions from known malware families to predict unknown malware, reducing memory usage and computational load through decision-tree fast matching and location-sensitive hashing, without examining raw files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virus dictionary approach with SHA-1 hash is used to detect known malware, then detection reliability is improved, but memory usage and CPU cycles increase dramatically due to bloat from large number of malware programs
Solution Approach 1:
The patent extracts only the essential identifying features (common substrings) from malware programs rather than storing complete malware instances or their full hashes. This extraction reduces the dictionary size from containing entire malware programs to containing only characteristic substrings, directly addressing the memory bloat problem while maintaining detection capability
Solution Approach 2:
The patent segments malware identification into smaller common substrings that can be shared across multiple malware variants. Instead of treating each malware program as a complete unit, the system breaks down malware into reusable substrate components, allowing efficient storage and faster matching
2Adaptability or versatility
If virus dictionary with large number of malware patterns is used, then coverage of known malware is improved, but scanning speed decreases due to time-consuming search through large dictionary
Solution Approach 1:
The patent creates compact representations (copies) of malware characteristics through common substrings rather than storing full malware programs. These substring copies serve as efficient proxies that maintain the ability to identify malware families while dramatically reducing the time required to search and compare during scanning operations
3Reliability
If behavior monitoring is used to detect unknown malware, then detection of zero-day threats is improved, but computational power requirement increases significantly affecting platform performance
Solution Approach 1:
The patent performs preliminary analysis during the offline training phase to identify common substrings and build the enhanced dictionary. This preliminary action extracts and stores only the essential identifying features before actual scanning occurs, so that runtime detection requires minimal computational resources while still being able to identify unknown malware variants
4Measurement precision
If instance-based malware patterns are used, then accuracy in detecting known malware is improved, but ability to identify unknown malware variants deteriorates
Solution Approach 1:
The patent creates a universal detection mechanism using common substrings that can identify multiple malware families and variants through shared characteristic patterns. These substrings serve multiple functions: they detect known malware with high accuracy, identify unknown variants through probability matching, and generalize across different malware families, thereby achieving both precision and adaptability
Data Source
AI summary
A training model for malware detection is developed using common substrings extracted from known malware samples. The probability of each substring occurring within a malware family is determined and a decision tree is constructed using the substrings. An enterprise server receives indications from client machines that a particular file is suspected of being malware. The suspect file is retrieved and the decision tree is walked using the suspect file. A leaf node is reached that identifies a particular common substring, a byte offset within the suspect file at which it is likely that the common substring begins, and a probability distribution that the common substring appears in a number of malware families. A hash value of the common substring is compared (exact or approximate) against the corresponding substring in the suspect file. If positive, a result is returned to the enterprise server indicating the probability that the suspect file is a member of a particular malware family.