Trojan Horse Propagation Tree for Source Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for determining the propagation relationship of Trojan horse files are inefficient, making it difficult to find the source of these malicious programs and effectively prevent their spread.
Innovation Solution
A method and device that utilize a propagation relationship tree to store and analyze Trojan horse files, searching for parent-child relationships level by level based on predefined conditions to identify and record propagation sources, thereby improving the chances of finding the origin of the files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If manual analysis and virtual machine running are used to determine Trojan horse propagation relationships, then the analysis can be performed with simple tools, but the efficiency is low and it is difficult to find the propagation source
Solution Approach 1:
The patent segments the propagation relationship determination into multiple levels (current level, parent level, child level) and processes each level systematically. The propagation relationship tree is divided into hierarchical levels that can be analyzed independently, allowing efficient traversal from leaf nodes upward to identify propagation sources without analyzing the entire dataset at once.
Solution Approach 2:
The patent performs preliminary actions by pre-storing propagation relationship data in a structured tree format with labeled levels before analysis. MD5 values and downloading addresses are pre-processed and organized into the tree structure, enabling rapid querying and source identification without requiring time-consuming manual analysis during the actual detection process.
2Reliability
If the entire propagation relationship tree is searched to find the propagation source, then the source may be found, but the search range is too large and reduces efficiency
Solution Approach 1:
The patent segments the search space by dividing the propagation relationship tree into hierarchical levels. Instead of searching the entire tree, the system focuses search efforts on specific levels (current level, parent level, or child level) based on the analysis objectives, significantly reducing the search range while maintaining the ability to find propagation sources.
Solution Approach 2:
The patent applies local quality by assigning different search strategies and depths to different parts of the tree. The search process can focus on local areas (specific levels or branches) rather than uniformly searching the entire tree, allowing efficient identification of propagation sources in relevant regions while ignoring unrelated areas.
3Productivity
If a level-by-level searching mechanism is used with controllable range, then the search efficiency improves, but the complexity of the searching process increases
Solution Approach 1:
The patent simplifies the complex search process by segmenting it into standardized level-based operations. Each level (current, parent, child) has a defined search procedure, transforming a potentially complex arbitrary search into a systematic sequence of simple level-traversal steps that are easier to implement and manage.
Solution Approach 2:
The patent introduces a hierarchical level dimension to organize the search process. By adding the level dimension (current level, parent level, child level), the search transforms from a two-dimensional graph traversal problem into a more manageable hierarchical structure that can be systematically explored layer by layer, reducing overall complexity.
Data Source
AI summary
A method performed by a computer system determines propagation relationships of Trojan horse files. A current Trojan horse file is stored into a corresponding current level of a propagation relationship tree. A condition of the current Trojan horse file or of the propagation relationship tree is assessed. The following steps are repeated until the condition is satisfied: search Trojan horse files for a parent, child or sibling relative to the current Trojan horse file, identify one of the Trojan horse files as the current Trojan horse file, and store the current Trojan horse file into a corresponding current level of the propagation relationship tree. When the condition is satisfied, the propagation relationship tree is displayed. The storing of the current Trojan horse file may include storing an identifier of the current Trojan horse file, which may include data abstraction output, and/or a downloading address of the current Trojan horse file.