Tetra File Structure Clustering for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems struggle to effectively identify malicious files due to the rapid evolution of malware variants and the use of packing, protecting, encrypting, and archiving tools, which complicate the identification of malicious code based on content or actions.
Innovation Solution
The system identifies malicious files by analyzing the structure of executable files using homomorphic encryption to generate an encrypted representation, allowing for clustering based on structural features, such as file headers and permissions, and comparing this representation with a database of known malicious files to identify families, variants, or identical structures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware detection systems analyze file content and actions, then detection capability is improved, but the system becomes vulnerable to packing tools and code modifications that obscure malicious content
Solution Approach 1:
The patent extracts the structural characteristics of malware files (such as section headers, import tables, and executable permissions) from the packed content. By taking out these structural elements that remain consistent despite packing, the system can identify malware families without being affected by packing tools or code modifications.
Solution Approach 2:
Instead of analyzing the content of malware files directly (which is obscured by packing), the patent inverts the approach by analyzing the structural framework and organizational patterns of the files. This structural analysis reveals the underlying malware family characteristics regardless of packing or modification.
2Object-affected harmful factors
If the system analyzes structural features of executable files, then resistance to packing tools is improved, but the complexity of file structure analysis increases
Solution Approach 1:
The patent segments the executable file structure into distinct components such as section headers, import tables, and permission attributes. By dividing the complex file structure into manageable segments, the system can analyze each component systematically to identify malware families without overwhelming complexity.
Solution Approach 2:
The patent transforms structural file characteristics into quantifiable parameters and features that can be systematically analyzed and compared. By changing the representation of file structures into standardized parameters, the complexity of analysis is managed through systematic parameter evaluation rather than raw structural parsing.
3Reliability
If the system uses homomorphic encryption to generate encrypted representations, then security and privacy are improved, but computational complexity and processing time increase
Solution Approach 1:
The patent applies homomorphic encryption to structural features and metadata before performing clustering and analysis operations. By performing the encryption as a preliminary action on the input data rather than during complex computational operations, the system maintains security while managing computational complexity through efficient encryption of only the necessary structural parameters.
Data Source
AI summary
Various embodiments provide systems and methods for identifying malicious files based upon file structure.