Silent-Mode Signature Testing for Anti-Malware Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional signature scanning methods for malware detection are limited in detecting unknown or newly created malware, as they rely on pre-existing signatures, and are resource-intensive, leading to high false positive rates and inefficiencies in updating anti-virus databases, which can result in undetected malware causing harm before corrections can be made.
Innovation Solution
The implementation of silent-signature testing, where tested signatures are not updated into black or white lists but sent directly to users, with checksums analyzed on a server to determine validity, reducing resource usage and improving response times to new threats, and allowing for the use of silent signatures in filtering unknown malware and parental control applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional signature scanning is used to detect malware, then known malware can be detected, but unknown or newly created malware cannot be detected and resource consumption is high
Solution Approach 1:
The system performs preliminary actions by pre-calculating and storing control values (checksums) for key portions of files during the file creation or update phase. When malware detection is needed, the system retrieves these pre-stored control values and compares them against malware signatures, avoiding the need to recalculate entire file hashes in real-time. This preliminary preparation significantly reduces the computational resources required during actual malware scanning operations.
2Reliability
If signature database updates are tested thoroughly before release, then collision errors are reduced, but the update process takes several hours and delays response to new threats
Solution Approach 1:
The system creates and uses copies of control values for testing purposes. When a new signature database update is being prepared, the system generates test copies of the update and validates them against a subset of files using pre-stored control values. This copying approach allows rapid testing without affecting the production system, enabling faster validation of signature updates while maintaining accuracy through controlled testing procedures.
3Reliability
If comprehensive signature testing is performed against all AV data, then collision probability is reduced, but the testing process requires excessive system resources
Solution Approach 1:
The system segments the comprehensive file database into smaller, manageable portions for testing. Instead of testing signatures against all files simultaneously, the testing process divides the database into subsets and validates signatures against each subset sequentially or in parallel. This segmentation approach maintains thorough collision detection capability while significantly reducing the resource burden by processing smaller data portions at any given time.
Solution Approach 2:
The system implements partial testing by validating signatures against a strategically selected subset of files rather than requiring complete coverage of the entire database. The testing process uses pre-stored control values to efficiently verify signatures against representative samples, achieving sufficient collision detection with reduced resource consumption compared to exhaustive testing of all files.
4Measurement precision
If MD5 algorithm is used to generate file signatures, then signature accuracy is high, but the computational task is intensive and requires a lot of system resources
Solution Approach 1:
The system extracts and stores only the essential control values (checksums) of key file portions during the file creation or update phase. Instead of calculating and storing complete MD5 hashes of entire files, the system identifies and extracts control values from critical sections of files, storing these extracted values for future comparison. This extraction approach maintains signature accuracy for malware detection while dramatically reducing the computational power required, as comparing small control values is much less intensive than calculating full file hashes.
Data Source
AI summary
Method and computer program product for signature testing used in anti-malware processing. Silent signatures, after being tested, are not updated into a white list and are sent directly to users instead. If the silent signature coincides with malware signature, a user is not informed. A checksum (e.g., hash value) of a suspected file is sent to a server, where statistics are kept and analyzed. Based on collected false positive statistics of the silent-signature, the silent-signature is either valid or invalid. Use of the silent signatures provides for effective signature testing and reduces response time to new malware-related threats. The silent signature method is used for turning off a signature upon first false positive occurrence. Use of silent signatures allows improving heuristic algorithms for detection of unknown malware.