Particle Encoding for Malware Threat Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional hash-based malware scanning systems are computationally expensive and difficult to scale due to the need to compute trillions of hashes for large files, making them inefficient for identifying malicious software.
Innovation Solution
The implementation of particle-based threat scanning, where particles are generated from known threats and safe samples, allowing for the detection of threat patterns using regular expressions, reducing the data needed for reliable identification by computing particles instead of full hashes, and using these particles to create a threat signature that excludes collisions with safe samples.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional hash-based scanning is used to identify malware, then identification accuracy is improved, but computational cost and processing time increase significantly
Solution Approach 1:
The patent segments the file into multiple particles (e.g., 4KB chunks) and computes hashes only for these segments rather than the entire file. This segmentation allows parallel processing of multiple particles simultaneously, dramatically reducing the time required for threat identification while maintaining accuracy through ensemble hashing methods that combine particle hashes.
Solution Approach 2:
The system performs partial hashing by computing hashes for only a subset of file particles rather than the complete file. The ensemble hash method combines results from multiple particles to achieve reliable identification. This partial action approach reduces computational burden and scanning time while maintaining sufficient accuracy for threat detection.
2Reliability
If full file hashing is computed for every sample, then reliable threat identification is achieved, but computational resources and processing overhead increase
Solution Approach 1:
The file is divided into multiple particles that are hashed independently and then combined using ensemble hashing. This segmentation allows the system to process only essential portions of the file, reducing computational energy consumption while maintaining detection reliability through the mathematical properties of ensemble hash functions that preserve collision resistance.
Solution Approach 2:
The patent changes the parameter of hash computation from full-file to partial-file (particle-level). By adjusting the particle size and number of particles processed, the system can optimize the balance between reliability and energy consumption. The ensemble hash method ensures that reliability is maintained even with reduced computational input.
3Productivity
If particles are used instead of full hashes, then scanning efficiency is improved, but data completeness for identification may be reduced
Solution Approach 1:
The file is segmented into particles that capture essential identifying features. The ensemble hash method processes these segments in parallel, improving scanning throughput. The segmentation is designed to preserve critical identification information in each particle while discarding redundant data, thus maintaining identification capability with reduced data completeness requirements.
Solution Approach 2:
The system extracts only the essential identifying particles from the file rather than processing the complete file data. This extraction focuses on portions of the file that contain unique identifying characteristics for threat detection, reducing data completeness requirements while maintaining scanning efficiency and identification accuracy.
Data Source
AI summary
A method of particle-based threat scanning may include obtaining a sample from a sample source, generating a plurality of particles from the sample, wherein each particle from the plurality of particles is an array of unique bytes generated based on one or more particle properties, and determining whether the sample is associated with a known threat by comparing the plurality of particles to particle threat signatures in a threat database.