Malicious File Detection via N-gram Sequence Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security software requires exact matches with known malicious files to detect and prevent malicious file execution, which is ineffective for files that differ in multiple respects from known threats, and consumes significant processing resources.
Innovation Solution
The method involves extracting sequential data from files, generating n-grams, creating a vector of weights based on frequency analysis, and using statistical analysis or machine learning models to determine the likelihood of a file being malicious, allowing for proactive corrective actions without prior knowledge of the file.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If exact match comparison with known malicious files is used, then detection reliability is improved, but adaptability to new or modified malicious files deteriorates
Solution Approach 1:
The patent transforms the detection approach by changing the parameters from exact file matching to n-gram sequence analysis. Instead of comparing entire files for exact matches, the system extracts sequential data (opcodes, bytes, or characters) and analyzes n-gram patterns. This parameter change enables the system to detect malicious files based on characteristic sequences while tolerating variations in non-critical portions, thereby maintaining detection reliability while improving adaptability to new or modified threats.
Solution Approach 2:
The patent segments the malicious file detection problem into discrete sequential elements (n-grams of opcodes, bytes, or characters). By dividing the file into overlapping sequences of n elements, the system can identify characteristic patterns without requiring exact whole-file matches. This segmentation allows the detection system to focus on critical sequential patterns while being tolerant of variations in other parts of the file.
2Measurement precision
If comprehensive file analysis is performed to improve detection accuracy, then detection precision is improved, but processing resource consumption increases
Solution Approach 1:
The patent extracts only the essential sequential data from files that is necessary for detection purposes. Instead of analyzing entire files or performing comprehensive scans, the system extracts sequential data (opcodes, bytes, or characters) and generates n-grams from these extracted elements. This extraction approach maintains high detection precision by focusing on characteristic patterns while significantly reducing processing resource consumption by avoiding analysis of redundant file portions.
Solution Approach 2:
The patent applies partial action by analyzing only the sequential patterns necessary for detection rather than performing complete file analysis. By generating n-grams from extracted sequential data and comparing these patterns against known malicious signatures, the system achieves sufficient detection precision without the excessive resource consumption of comprehensive file scanning. The approach performs just enough analysis to identify malicious patterns while avoiding unnecessary processing.
Data Source
AI summary
Under one aspect, a method is provided for protecting a device from a malicious file. The method can be implemented by one or more data processors forming part of at least one computing device and can include extracting from the file, by at least one data processor, sequential data comprising discrete tokens. The method also can include generating, by at least one data processor, n-grams of the discrete tokens. The method also can include generating, by at least one data processor, a vector of weights based on respective frequencies of the n-grams. The method also can include determining, by at least one data processor and based on a statistical analysis of the vector of weights, that the file is likely to be malicious. The method also can include initiating, by at least one data processor and responsive to determining that the file is likely to be malicious, a corrective action.