Network Device File Identification via Hash Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network security applications face difficulties in identifying all files belonging to malicious applications, especially those with multiple files and versions, which can leave network devices vulnerable to damage.
Innovation Solution
A computer-implemented method that collects file attributes, examines file hashes, summarizes attributes using techniques like count-min sketch, clusters files into applications using cosine similarity or minhashing, and makes security decisions to block malicious applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a network security application uses traditional file identification methods, then it can detect single-file malicious applications, but it cannot effectively identify multi-file malicious applications and their multiple versions
Solution Approach 1:
The patent segments the malicious application into multiple individual files and creates separate hash-based identifiers for each file. This segmentation allows the security system to track and identify each component file independently, enabling comprehensive detection of multi-file applications and their various versions through collective monitoring of all file segments.
Solution Approach 2:
The patent implements a universal identification mechanism using hash functions that can handle both single-file and multi-file applications uniformly. The same hash-based identification approach works across different application types, versions, and file structures, providing a versatile solution that adapts to various malicious application formats without requiring separate detection methods.
2Reliability
If the network security application monitors all files on network devices, then it can identify malicious applications, but the complexity of tracking and managing multiple files increases significantly
Solution Approach 1:
The patent creates hash-based copies or representations of file identifiers instead of directly monitoring and managing the actual files. These hash copies serve as simplified proxies that capture the essential identification information while reducing the complexity of tracking. The system manages these lightweight hash representations rather than the full file metadata, significantly reducing system complexity while maintaining reliable identification and protection capabilities.
Data Source
AI summary
Securing a network device by automatically identifying files belonging to an application. In one embodiment, a method may include collecting file attributes for multiple files from multiple network devices, examining a hash of file contents of each of the multiple files to identify multiple unique files in the multiple files, summarizing the file attributes for each of the multiple unique files to generate a sketch of file attributes for each of the multiple unique files, clustering the multiple unique files into multiple applications, making a security action decision for one application of the multiple applications, and performing a security action on a network device based on the security action decision.