Vector Variation Malware Detection for Partial File Changes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cybersecurity attacks that partially modify data in a target file are difficult to evaluate due to their relatively small effects, making it challenging for existing cybersecurity measures to identify the scope and impact of such attacks.
Innovation Solution
A data storage computing system generates vectors based on file portions to detect variations, classifying anomalies indicative of malware by comparing vectors associated with different parts of a file and determining appropriate actions based on the variation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cybersecurity measures (software updates, network protocols, user training) are deployed, then protection against malware is improved, but detection capability for partial modifications remains insufficient
Solution Approach 1:
The patent segments the file into multiple portions (e.g., paragraphs, sentences, or data blocks) and analyzes each portion independently using vector representations. This allows detection of partial modifications that would be invisible in a holistic file analysis, resolving the contradiction between general protection and specific detection capability.
Solution Approach 2:
The patent replaces traditional mechanical/Rule-based detection methods with a vector-based mathematical representation system. By converting file portions into vectors and comparing them, the system achieves more sophisticated detection of partial modifications while maintaining integration with existing cybersecurity frameworks.
2Measurement precision
If vector comparison is performed on entire files, then detection accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
Instead of vectorizing the entire file, the system divides the file into smaller portions (paragraphs, sentences, or data blocks) and creates vectors for each portion. This segmentation maintains detection accuracy for local modifications while significantly reducing the computational burden compared to analyzing the entire file.
Solution Approach 2:
The system performs vector comparison only on portions of the file that show variation or anomaly, rather than systematically analyzing every portion. This selective approach maintains high detection accuracy for malicious modifications while minimizing unnecessary processing time.
Data Source
AI summary
Disclosed herein are methods, systems, and apparatus for the detection of data integrity anomalies indicative of malware for a datastore of an organization. To identify an anomaly in a file, a portion of a file is identified to be used in a vector comparison. The portion can comprise sentences or paragraphs for text files, entries, rows, or columns for spreadsheet files, or some other divisible portion of a file. A vector having multiple dimensions is generated for the portion based on the content in the portion. Each dimension of the multiple dimensions corresponds to a feature of the portion. A variation is determined between the vector and one other vector associated with one other portion of the file. One or more actions to take with respect to the file is determined based on the variation, such as malware mitigation, and the action is performed with respect to the file.