Program Section Segmentation for Malware Detection Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for comparing and identifying computer programs in binary format are inefficient and prone to errors, especially when dealing with optimizations and variations caused by different compilers or microprocessors, making it difficult to recognize malware and identify alterations in computer programs.
Innovation Solution
A method that breaks down computer program sections into segments, defines program flow relationships, and compresses characteristic data to form a signature that identifies the program section, allowing for efficient and reliable comparison and identification of matching or altered programs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the source text is translated completely into microprocessor-specific format using a compiler, then execution efficiency is improved, but the ability to identify and compare program identity across different compilers or microprocessors deteriorates
Solution Approach 1:
The patent divides the computer program into multiple sections based on code segments and control flow relationships. Each section is independently analyzed and assigned a signature, allowing comparison without requiring full program translation. This segmentation enables reliable identification while maintaining execution efficiency by working with smaller, manageable units.
Solution Approach 2:
The patent introduces an intermediary representation (control flow graph and section signatures) that bridges the gap between high-level source code and machine-specific binary format. This intermediary structure captures program logic independently of compiler optimizations or target architecture, enabling reliable program identification across different compilation environments.
2Productivity
If compiler optimizations are applied to improve execution efficiency, then program performance is improved, but the ability to detect malware and identify alterations deteriorates
Solution Approach 1:
The patent performs preliminary analysis of the program's control flow structure and code segments before execution or comparison. By establishing section boundaries and control flow relationships in advance, the method creates a stable reference framework that remains valid even after compiler optimizations alter the binary representation, enabling reliable malware detection.
Solution Approach 2:
The patent changes the analysis parameters from binary-level details (which are sensitive to compiler optimizations) to control flow and code segment characteristics (which are invariant under optimization). This parameter transformation allows the system to maintain detection capability despite performance-optimizing transformations.
3Adaptability or versatility
If reverse translation (disassembly) is used to convert binary format to assembler source text, then program comparability is improved, but information loss from original source text and reproduction of compiler optimizations worsen identification accuracy
Solution Approach 1:
The patent extracts only the essential structural information (control flow relationships and code segment boundaries) from the binary program, discarding irrelevant details such as specific instruction encodings and compiler-generated artifacts. This extraction process creates a compact representation that enables comparison without suffering from information loss or optimization artifacts.
4Measurement precision
If complete program comparison is performed to ensure accurate identification, then identification accuracy is improved, but computational complexity and processing time worsen
Solution Approach 1:
The patent segments the program into independent sections that can be analyzed and compared separately. Each section receives a signature based on its control flow and code characteristics, allowing efficient comparison through signature matching rather than complete program analysis. This maintains identification accuracy while reducing computational complexity.
Solution Approach 2:
The patent applies partial analysis by focusing only on the critical structural elements (control flow graphs and code segment boundaries) rather than analyzing every instruction. This selective approach achieves sufficient identification accuracy with significantly reduced processing requirements compared to complete program comparison.
Data Source
AI summary
A method for characterizing a computer program section held in a computer memory system may include dividing the computer program section into segments, where program commands contained in the computer program section may be used to define a program flow relationship between the segments, and determining characteristic data which may be associated with the program flow relationship of the segments. The characteristic data may be compressed to form a signature which identifies the computer program section.