Multi-Tier Static File Scanning for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems fail to detect application version-specific exploits and those embedded in non-executable files, as they often go undetected by traditional malware detection methods.
Innovation Solution
A multi-tier static scanning system that deconstructs files through decompression, disassembly, decompilation, and de-obfuscation, followed by heuristic and deterministic checks, and emulation to identify malware patterns and vulnerabilities, providing a comprehensive analysis to detect hidden malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware detection methods are used, then the detection process is simple and fast, but application version-specific exploits and malware in non-executable files are not detected
Solution Approach 1:
The scanning system is divided into multiple independent tiers: first tier performs quick signature-based detection, second tier performs static analysis on suspicious files, and third tier performs dynamic analysis in isolated environments. Each tier handles specific types of threats, allowing the system to achieve high detection accuracy while maintaining operational efficiency through progressive deepening of analysis only where needed.
Solution Approach 2:
The system performs preliminary static analysis including file deconstruction, decompression, disassembly, and decompilation before dynamic execution. This preliminary action extracts and analyzes code, strings, and metadata from files in advance, identifying suspicious patterns and preparing data structures that will be used during dynamic analysis, thereby improving overall detection accuracy without requiring all files to undergo complete dynamic analysis.
2Measurement precision
If multi-tier static scanning is performed, then detection accuracy improves, but scanning time increases
Solution Approach 1:
The scanning process is segmented into three distinct tiers with increasing depth and decreasing speed. The first tier uses fast signature matching for immediate threats, the second tier uses static analysis for suspicious files, and the third tier uses dynamic analysis for highly suspicious cases. This segmentation allows the majority of files to be processed quickly while allocating intensive resources only to files that warrant deeper analysis.
Solution Approach 2:
The system applies partial analysis to most files (first tier signature matching) and reserves excessive/deep analysis (dynamic execution and full deconstruction) only for files that trigger suspicion thresholds. This approach ensures that detection accuracy is maintained for malicious files while minimizing time loss on benign files that require only lightweight scanning.
3Measurement precision
If files are deconstructed through decompression, disassembly, and decompilation, then hidden malware is revealed, but processing complexity increases
Solution Approach 1:
The file deconstruction process is segmented into distinct modules: decompression module for archived files, disassembly module for binary code conversion to assembly language, decompilation module for converting machine code to high-level language, and static analysis module for examining extracted code and strings. Each module handles specific file formats and transformation types, making the overall complex process manageable and maintainable through clear separation of concerns.
Solution Approach 2:
The system uses intermediate representations and data structures to bridge different analysis stages. For example, files are first converted to standardized internal representations during deconstruction, then analyzed using pattern matching and heuristic algorithms. These intermediaries simplify the complexity by providing uniform interfaces between diverse file formats and analysis methods, allowing the system to handle multiple file types without proportionally increasing processing complexity.
Data Source
AI summary
According to one embodiment, a computerized method comprises conducting a first static scan on content within a file. Thereafter, if the first static scan did not result in the file being classified as malicious, the file is deconstructed to gain access to one or more objects within the file. A second static scan associated with the one or more objects is performed to determine whether the one or more objects are suspected of including malware. The file may then be classified as malicious based on results of the second static scan.