Pattern Matching Expression With Embedded Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current pattern matching techniques for detecting malicious computer code are limited in their ability to effectively handle polymorphic viruses and other malicious code that employs alternate encoding, leading to high false positive rates and inefficiencies in intrusion detection.
Innovation Solution
The method involves composing a pattern matching expression and embedding functions within it to form a character matching string, allowing for comparisons that are insensitive to case and alternate encoding, using regular expressions or other patterns that can be represented by deterministic finite state automata or push-down automata, enabling advanced algorithmic processing and detection capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional pattern matching techniques are used for detecting malicious computer code, then the detection process is simple and fast, but the ability to handle polymorphic viruses and alternate encoding is limited, leading to high false positive rates
Solution Approach 1:
The patent embeds functions directly within pattern matching expressions, creating a nested structure where functional logic is contained inside the expression itself. This allows complex detection capabilities to be packaged within the existing pattern matching framework, improving reliability without proportionally increasing external system complexity
Solution Approach 2:
The pattern matching expression is enhanced to perform multiple functions simultaneously - it can match patterns, execute functions, handle alternate encoding, and process polymorphic variations all within a single unified expression structure. This multi-functionality reduces the need for separate detection mechanisms, maintaining simplicity while improving accuracy
2Adaptability or versatility
If traditional pattern matching is used, then the scanning process is efficient, but it cannot effectively handle polymorphic viruses and alternate encoding
Solution Approach 1:
The patent introduces dynamic function execution within the pattern matching expression, allowing the expression to adapt its behavior based on the input data. The embedded functions can dynamically adjust matching criteria to handle polymorphic variations and alternate encoding schemes, enabling the system to adapt to evolving malicious code while maintaining scanning efficiency through optimized function execution
3Measurement precision
If traditional pattern matching expressions are used, then the system is simple to implement, but false positive rates are high
Solution Approach 1:
The embedded functions within the pattern matching expression provide feedback mechanisms that allow the system to learn from and correct false positive detections. The functions can analyze matching results and adjust subsequent pattern matching operations, reducing false positive rates through iterative refinement while keeping the overall expression structure manageable through functional encapsulation
Data Source
AI summary
Methods, apparati, and computer-readable media for matching patterns of symbols within computer systems. A method embodiment of the present invention comprises composing (11) a pattern matching expression; and embedding (12) a function using storage means within the expression to form a character matching string. The expression may be a regular expression. The character matching string is compared (13) against a target string. The target string may be one that is suspected to contain malicious computer code.