Similarity-Based Hashing for Malware Module Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security threat detection technologies, such as signature matching and binary analysis, are ineffective against rapidly evolving malware variants, leading to undetected infections and increased risks for enterprises due to the emergence of exploit toolkits and various infection vectors.
Innovation Solution
A method utilizing similarity-based hashing of software module signatures to classify potentially malicious software modules, including malware and PUPs, by preparing data representations, performing similarity-based queries, computing distances, and generating notifications to control access on client devices, implemented in a processing device within a security operations center or network security system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature matching and binary analysis are used for malware detection, then detection accuracy for known malware is improved, but detection effectiveness against new malware variants deteriorates
Solution Approach 1:
The patent transforms the malware detection approach by changing from exact signature matching to similarity-based detection using hashing functions. Instead of requiring precise matches between known malware signatures and new variants, the system uses Locality-Sensitive Hashing (LSH) to identify similar patterns, allowing detection of novel malware that shares characteristics with known threats while maintaining scalability through parameter-based similarity measurement.
Solution Approach 2:
The patent creates simplified copies of malware characteristics through hashing functions that generate compact representations of malware binaries. These hash copies preserve essential similarity information without requiring storage or comparison of complete malware signatures, enabling efficient detection of new variants through pattern matching on the hashed representations rather than full binary analysis.
2Measurement precision
If comprehensive binary analysis is performed on all software modules, then detection precision is improved, but processing time and computational resources increase
Solution Approach 1:
The patent segments the malware detection process into two distinct phases: a fast filtering phase using Locality-Sensitive Hashing to identify candidate similar binaries, and a slower verification phase using comprehensive binary analysis only on the reduced candidate set. This segmentation allows the system to achieve high detection precision through detailed analysis while minimizing overall processing time by applying intensive analysis only where necessary rather than to all software modules.
Solution Approach 2:
The patent applies partial action by performing comprehensive binary analysis only on a small subset of candidate malware identified through rapid hashing-based filtering, rather than conducting full analysis on all software modules. This selective approach maintains high detection precision for suspicious files while avoiding the excessive time and computational resources that would be required for exhaustive analysis of entire software catalogs.
3Reliability
If traditional signature matching is used, then false positives are reduced, but ability to detect zero-day malware deteriorates
Solution Approach 1:
The patent introduces Locality-Sensitive Hashing as an intermediary mechanism between exact signature matching and comprehensive binary analysis. This intermediary layer generates probabilistic similarity scores that identify potential malware matches without requiring precise signature correspondence, thereby reducing false positives from over-aggressive matching while simultaneously enabling detection of zero-day variants through similarity-based pattern recognition rather than exact matches.
Data Source
AI summary
A method includes preparing a representation of data associated with a plurality of software modules, the representation comprising similarity-based hashing of signatures constructed from a first subset of features of the plurality of software modules. The method also includes performing a similarity-based query utilizing the similarity-based hashing of signatures to identify one or more of the plurality of software modules as candidate software modules matching a received seed software module. The method further includes computing distances between the candidate software modules and the seed software module utilizing a second subset of features of the plurality of software modules, classifying one or more of the candidate software modules as a designated type based on the computed distances, generating a notification comprising a list of the classified candidate software modules, and controlling access by one or more client devices associated with an enterprise to the candidate software modules in the list.