Structural Similarity Hashing for Zero-Day Malware Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures struggle to provide effective zero-day/zero-hour protection against rapidly morphing malware threats, especially in cloud-based systems, and there is a need for improved methods to identify and classify files as malware, clean, or unknown.
Innovation Solution
Implementing Structural Similarity Hash (SSHash) to analyze files based on auxiliary information and complexity, querying a database for similar files, and defining the file as malware, clean, or unknown, with additional steps involving sandbox analysis and threat intelligence services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security measures are used to detect malware, then the system can identify known malware signatures, but it fails to provide effective zero-day/zero-hour protection against rapidly morphing malware threats
Solution Approach 1:
The patent segments the file analysis process into multiple independent components: extracting auxiliary information (file headers, metadata), computing complexity metrics for different file sections, and generating SSHash values. This segmentation allows each component to specialize in detecting specific malware characteristics, improving both reliability and adaptability to morphing threats.
Solution Approach 2:
The patent transforms the malware detection approach by changing parameters from traditional signature matching to a multi-parameter analysis system that computes auxiliary information, complexity metrics, and structural similarity hashes. This parameter transformation enables detection of morphing malware by focusing on structural characteristics that remain consistent despite surface-level changes.
2Reliability
If SSHash computation is performed for every unique file to identify similar files, then zero-day protection is achieved, but the processing time and computational resources increase
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing SSHash values for files in a database before they are needed for detection. When a new file arrives, the system retrieves pre-computed hashes for comparison rather than performing full SSHash computation, dramatically reducing processing time while maintaining zero-day protection capability.
Solution Approach 2:
The patent uses copying by creating and storing simplified representations (SSHash values) of files in a database. These hash copies serve as proxies for full file analysis, allowing rapid comparison and identification of similar files without repeatedly processing the complete original files, thus reducing computational overhead and processing time.
3Reliability
If the system analyzes a large volume of user traffic to identify malware, then comprehensive security coverage is provided, but the complexity of the security system increases
Solution Approach 1:
The patent extracts only the most critical and discriminative features from files for analysis: auxiliary information (file headers, metadata) and complexity metrics of specific sections. By taking out only these essential elements rather than analyzing entire files, the system maintains comprehensive security coverage while reducing processing complexity and resource requirements.
Solution Approach 2:
The patent creates a universal SSHash computation framework that can analyze multiple file types (documents, executables, archives) using the same core methodology. This multi-functional approach allows the system to provide comprehensive security coverage across diverse file formats without proportionally increasing system complexity, as the same extraction and hashing mechanisms apply universally.
Data Source
AI summary
Systems and methods for structural similarity based hash for sample identification and detection include, monitoring traffic associated with a cloud-based system; identifying a unique file within the traffic and computing a Structural Similarity Hash (SSHash) for the file, wherein the SSHash is based on auxiliary information and a complexity of the file; identifying one or more similar files based on the SSHash; and defining the file as belonging to one or more groups based on the one or more similar files.