Malicious Code Detection via Syntax Tree Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current firewall technologies are ineffective in preventing the penetration of viruses and worms into computer networks, allowing networks to become compromised before malicious code can be detected and mitigated.
Innovation Solution
A method using fuzzy hashing to detect malicious program code by generating hash digests from parsed trees of data files, allowing for the identification of compromised files before they are executed, by comparing these digests to known malware-free files and flagging discrepancies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional firewall detection methods are used, then network security monitoring is provided, but malicious code penetration cannot be prevented in time
Solution Approach 1:
The patent performs preliminary actions by generating hash digests of parsed trees for all data files before execution and storing them in a database. This pre-computation allows for rapid comparison during runtime, enabling detection before malicious code can penetrate or execute, thus resolving the contradiction between security reliability and detection time loss
Solution Approach 2:
The patent replaces traditional mechanical firewall scanning methods with a computational approach using hash digest comparison. Instead of scanning entire files during detection, the system substitutes this with efficient hash-based fingerprinting and comparison, dramatically reducing detection time while maintaining or improving security reliability
2Measurement precision
If file scanning is performed after penetration, then compromised files can be identified, but the network is already partially compromised
Solution Approach 1:
The system performs preliminary hashing and storage of legitimate file fingerprints before any potential compromise occurs. When a file is accessed, its hash is immediately compared against the stored database, enabling identification and blocking of compromised files before they can affect the network, thus achieving both precise identification and preventing harm
Solution Approach 2:
The patent implements preliminary anti-action by pre-establishing a database of legitimate file hash digests and using this to proactively identify and block malicious files before they can cause harm. The system is prepared in advance with counter-measures (the hash database) that enable immediate detection and prevention when suspicious files appear
3Reliability
If traditional virus detection is used, then known viruses can be detected, but sophisticated malware can penetrate the network
Solution Approach 1:
The patent creates a computational copy (hash digest) of each file's parsed tree structure, which serves as a fingerprint. This copy enables detection of both known and unknown malware by comparing structural fingerprints rather than relying on signature databases, thus improving both detection reliability and adaptability to sophisticated or novel malware
Solution Approach 2:
The system changes the detection parameter from content-based virus signatures to structure-based hash digests of parsed trees. This parameter transformation enables the system to detect malware based on its structural characteristics rather than known virus patterns, significantly improving adaptability to sophisticated and zero-day malware while maintaining detection reliability
Data Source
AI summary
Techniques are described herein for detecting malicious program code stored on computer devices before the code can be executed to potentially compromise a computer network. In an embodiment, a method comprises receiving, at a computer device, a file containing instructions in a programming language; based on a syntax of the programming language, parsing the file to generate parsed information, and based on the parsed information, generating a syntax tree for the file; identifying one or more alphanumeric strings in the syntax tree, and based on the alphanumeric strings, generating a syntax string for the syntax tree; generating a hash digest by applying a piecewise hashing to the alphanumeric strings in the syntax string; determining whether the hash digest indicates that the file contains potentially malicious code; in response to determining that the hash digest indicates that the file contains the potentially malicious code, performing a responsive action.