Software Module Classification via Feature Distance Metrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security detection technologies are ineffective against evolving malware variants due to reliance on signature matching and binary analysis, which are easily evaded by attackers using exploit toolkits, leading to increased malware infections and potential data breaches.
Innovation Solution
A method for classifying software modules that uses a combination of static, behavior, and context features to compute distance metrics and cluster unknown software modules with previously classified benign or malicious modules, allowing for improved identification and modification of access rights to potentially malicious software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature matching and binary analysis are used for malware detection, then detection accuracy for known malware is improved, but detection effectiveness against evolving malware variants deteriorates
Solution Approach 1:
The patent transforms the detection approach by changing from signature-based parameters to behavioral and contextual parameters. Instead of matching known malware signatures, the system analyzes runtime behavior features (file system operations, registry modifications, network connections) and contextual features (process tree, parent process information) to detect both known and evolving malware variants effectively
Solution Approach 2:
The system implements dynamic analysis by monitoring software modules during runtime execution rather than relying on static binary analysis. This allows the detection system to adapt to evolving malware by observing actual behavior patterns rather than predetermined signatures, enabling detection of new variants that have not been previously identified
2Adaptability or versatility
If exploit toolkits are used to create new malware variants, then ability to evade current detection technologies is improved, but security against malware attacks deteriorates
Solution Approach 1:
The patent converts the harmful behavior of malware (its attempts to evade detection through transformation) into a beneficial detection mechanism. By monitoring behavioral patterns and contextual features during runtime, the system can identify malicious activities regardless of how the malware has been transformed or obfuscated by exploit toolkits
Solution Approach 2:
The system implements feedback mechanisms where detected malware behavior patterns are used to refine and improve detection algorithms. The behavioral and contextual features collected during runtime analysis provide continuous feedback that helps the system adapt to new malware variants and improve overall detection effectiveness over time
Data Source
AI summary
A method comprises obtaining at least a first software module not classified as benign or potentially malicious, extracting a set of features associated with the first software module including static, behavior and context features, computing distance metrics between the extracted feature set and feature sets of a plurality of clusters including one or more clusters of software modules previously classified as benign and exhibiting a first threshold level of similarity relative to one another and one or more clusters of software modules previously classified as potentially malicious and exhibiting a second threshold level of similarity relative to one another, classifying the first software module as belonging to a given cluster based at least in part on the computed distance metrics, and modifying access by a given client device to the first software module responsive to the given cluster being a cluster of software modules previously classified as potentially malicious.