Polymorphic Malware Detection via Metadata Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Polymorphic malware poses a significant challenge for anti-virus systems as it can be packed in different ways, generating unique hash values that are difficult to detect using traditional static signature-based methods, making it hard for anti-virus applications to identify and prioritize for analysis.
Innovation Solution
A server-based method that receives hash values and metadata from client devices, clusters similar metadata, and determines if a file is likely polymorphic by comparing received data with stored records, generating fingerprints based on metadata to identify and prioritize potentially malicious files for further analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional static signature-based methods are used to detect malware, then simple and fast detection is achieved, but polymorphic malware with unique hash values cannot be effectively detected
Solution Approach 1:
The patent transitions from single-dimension hash-based detection to multi-dimensional detection by incorporating metadata clustering. Instead of relying solely on hash values, the system analyzes metadata patterns (file characteristics, behavior, structure) to identify polymorphic malware, adding a new dimension to the detection approach that enables reliable identification of uniquely hashed malicious files.
Solution Approach 2:
The patent introduces metadata as an intermediary element between the malware file and the detection system. By analyzing metadata patterns and clustering similar files, the system creates a mediator that helps identify polymorphic malware without directly analyzing the unique hash values, thereby overcoming the detection difficulty while maintaining reliability.
2Adaptability or versatility
If polymorphic malware is packed in different ways to generate unique hash values, then evasion of detection is improved, but identification and prioritization for analysis becomes difficult
Solution Approach 1:
The patent implements a feedback mechanism where metadata from analyzed files is clustered and stored for future reference. When new files are encountered, their metadata is compared against existing clusters to identify patterns and prioritize analysis. This feedback loop enables the system to adapt to polymorphic malware variations while maintaining efficient prioritization based on historical data.
Solution Approach 2:
The patent changes the detection parameters from static hash values to dynamic metadata patterns. By analyzing multiple metadata parameters (file structure, behavior, characteristics) and clustering them, the system can identify polymorphic malware variants and prioritize them for analysis based on metadata similarity rather than unique hashes, thereby maintaining productivity despite malware adaptability.
3Reliability
If client/server model is used with centralized database, then global malware situation analysis is improved, but data transmission and processing requirements increase
Solution Approach 1:
The patent extracts only the necessary metadata information from file analysis and transmits it to the server for clustering and global analysis. Instead of transferring complete file data, the system extracts and sends only the relevant metadata patterns, reducing data transmission requirements while maintaining the ability to perform comprehensive global malware analysis.
Solution Approach 2:
The patent segments the detection system into client-side file analysis and server-side metadata clustering. By dividing the complex task into separate modules, each handling specific functions (local file scanning vs. global pattern matching), the system reduces overall complexity while enabling reliable global malware situation analysis through coordinated operation of segmented components.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
A method and apparatus for identifying an electronic file as polymorphic malware. A server receives from a client device a hash value and metadata associated with an electronic file. The server determines that the received metadata relates to corresponding metadata stored at a database, the corresponding stored metadata being associated with a further hash value that differs from the received hash value. A determination is made that each of the received hash values have been reported by fewer than a predetermined number of clients and, as a result, it is determined that the electronic file is likely to be polymorphic malware.