Software Path Signature Hash Tables for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The complexity of contemporary software makes it difficult to define normal and abnormal behaviors, leading to false positive identifications of malicious activities during software execution monitoring, where correct but rare behaviors are misclassified as malicious.
Innovation Solution
The use of path signatures generated from event data in a trusted environment, followed by hashing to create approximate nearest neighbor searching hash tables, allows for behavioral classification of software execution in both trusted and non-trusted environments, reducing false positives by determining similarity based on hash collisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software execution is monitored to detect malicious activities, then security detection capability is improved, but false positive rate increases due to misclassification of rare correct behaviors
Solution Approach 1:
The patent segments the behavioral analysis into multiple dimensions by creating hash tables organized by different path signature lengths (e.g., length 3, 4, 5). This segmentation allows the system to analyze rare behaviors at appropriate granularities, preventing misclassification of correct but uncommon execution paths as malicious.
Solution Approach 2:
The system performs preliminary action by pre-computing and storing hash tables of normal path signatures during a trusted execution phase before actual malware detection begins. This pre-characterization of normal behavior enables accurate comparison during monitoring, reducing false positives while maintaining high detection accuracy.
2Measurement precision
If detailed behavioral monitoring is implemented to reduce false positives, then classification accuracy is improved, but computational complexity increases
Solution Approach 1:
The patent extracts the computationally intensive hashing and comparison operations into pre-computed hash tables stored in memory. By extracting this complexity from real-time execution and storing results for quick lookup, the system achieves high classification accuracy without burdening the runtime performance with complex computations.
Solution Approach 2:
The system creates copies of path signature data in organized hash table structures during a preliminary phase. These copied and organized representations enable fast comparison operations during actual malware detection, reducing the computational burden while maintaining detailed behavioral analysis capability.
3Measurement precision
If path signatures are generated from event data to classify software behavior, then behavioral classification accuracy is improved, but data processing time increases
Solution Approach 1:
The system performs preliminary action by generating and organizing path signature hash tables during a trusted execution phase before actual malware detection. This pre-computation stores the time-consuming classification logic in accessible structures, enabling rapid classification during runtime without sacrificing accuracy.
Solution Approach 2:
The patent replaces the mechanical process of real-time path signature generation and comparison with a lookup-based system using pre-computed hash tables. This substitution transforms the time-intensive computational mechanics into faster memory access operations, reducing processing time while maintaining classification precision.
Data Source
AI summary
Techniques, supported by corresponding apparatuses and methods, are disclosed for monitoring execution of software in a trusted environment and generating path signatures which are characteristic of the behaviour of the software. Multiple approximate nearest neighbour searching hash tables are generated in dependence on such path signatures and on attribute information defining behavioural classifications for the path signatures. Later execution of the software in a non-trusted environment is monitoring and an observed path signature characteristic of the behaviour of the software is generated. This observed path signature is queried against the multiple approximate nearest neighbour searching hash tables and a behavioural classification is determined in dependence on hash collision-based similarity between the observed path signature and the content of the multiple approximate nearest neighbour searching hash tables.