Perceptive Hash Analysis for Malicious Intermediate Language Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying malicious intermediate language files are resource and time intensive, making them inefficient in detecting harmfulness effectively.
Innovation Solution
A system and method that involves calculating a perceptual hash of resources from a file, comparing it with known malicious files, determining similarity, and quarantining or removing files exceeding a predetermined threshold, while applying filters to discard randomly generated resources and combining hashes for efficient detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current methods are used to identify malicious intermediate language files, then detection accuracy is maintained, but resource consumption and time requirements increase significantly
Solution Approach 1:
The patent segments the intermediate language file into distinct resource sections and metadata sections. The perceptive hash is calculated only on the resource sections, which contain the malicious content, while excluding metadata that would increase processing overhead. This segmentation allows efficient comparison without sacrificing detection accuracy.
Solution Approach 2:
The patent extracts and compares only the essential perceptive hash values from resource sections, removing unnecessary metadata and non-critical file components from the analysis. This extraction approach maintains detection precision by focusing on the malicious content while reducing resource consumption and processing time.
2Reliability
If comprehensive analysis of all file resources is performed, then detection reliability is improved, but processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary calculation of perceptive hashes on resource sections before the actual malicious content analysis. By pre-processing and hashing the resource data, the system establishes a baseline for quick comparison against known malicious patterns, improving reliability while reducing the time required for comprehensive analysis.
Solution Approach 2:
The patent changes the analysis parameter from examining complete file contents to comparing perceptive hash values. This parameter transformation maintains detection reliability by preserving the essential characteristics of malicious content while dramatically reducing processing time and computational resource requirements.
3Speed
If perceptive hash comparison is applied to all files, then detection speed increases, but resource consumption for hash calculation and storage increases
Solution Approach 1:
The patent extracts perceptive hashes only from resource sections of intermediate language files, excluding metadata and other non-essential portions. This selective extraction reduces the amount of data requiring hash calculation and storage, thereby lowering computational resource consumption while maintaining detection speed through focused comparison of critical content.
Data Source
AI summary
Disclosed are systems and methods for detection of malicious intermediate language files. In one exemplary aspect, the system comprises a database comprising hashes of known malicious files, a resource allocation module configured to select a set of resources from a file being analyzed, a hash calculation module, coupled to the resource allocation module, configured to calculate a perceptive hash of the set of resources; and an analysis module, coupled to the other modules, configured to identify a degree of similarly between the set of resources and a set of resources from known malicious files by comparing the perceptive hash with perceptive hashes of the set of resources from known malicious files, determine a harmfulness of the file being analyzed based on the degree of similarity and remove or quarantine the file being analyzed when the harmfulness exceeds a predetermined threshold.