Perceptual Image Hashing for Malware Icon Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods are inconsistent and struggle to identify new versions of malware due to rapid binary changes and the use of similar icons, which can mimic legitimate software, making it difficult to distinguish between legitimate and malicious software.
Innovation Solution
The system generates perceptual image hashes for icons using a Discrete Cosine Transformation (DCT) and weighted Hamming distance comparison, allowing for the identification of visual similarities and separation of suspicious icons from legitimate ones, even when icons are resized or modified slightly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection methods are used for malware identification, then detection of known malware samples is achieved, but detection consistency deteriorates and new malware versions are missed due to rapid binary changes
Solution Approach 1:
The patent transforms malware detection from binary signature matching to perceptual hash parameter comparison. By converting icons to perceptual hash values and comparing these parameters, the system achieves consistent detection across malware versions while adapting to binary changes. The perceptual hash parameters remain stable despite binary modifications, resolving the contradiction between detection consistency and adaptability to new versions.
2Measurement precision
If traditional icon comparison methods are used, then exact matches can be identified, but visual similarities between legitimate and malicious icons cannot be distinguished
Solution Approach 1:
The patent replaces traditional mechanical icon comparison methods with perceptual hashing technology. Instead of comparing pixel-by-pixel or binary data, the system uses perceptual hash algorithms that capture visual similarity in a compressed representation. This substitution enables detection of visually similar icons that traditional methods would miss, reducing false negatives while maintaining measurement precision through the perceptual hash comparison mechanism.
3Adaptability or versatility
If malware binaries are frequently updated to evade detection, then evasion of signature-based detection is achieved, but visual identity of malware icons remains consistent
Solution Approach 1:
The patent inverts the detection approach by not detecting binary changes directly, but rather detecting visual consistency despite binary changes. Instead of following the malware's strategy of changing binaries to evade detection, the system uses the opposite approach: it detects malware by identifying consistent visual characteristics (icons) that persist across binary variations. This inversion allows detection of malware families even when binaries are frequently updated, while maintaining sensitivity to visual identity.
Data Source
AI summary
Systems and methods generate a perceptual image hash of an image. The perceptual image hash can be generated from multiple features extracted from a DCT transformation of the image. The perceptual image hash can be compared to other perceptual image hash values using a weighted Hamming distance function.