Virtual Stack Machine File Detection via Statistical Checksums
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus technologies face challenges in detecting harmful files on virtual stack machines due to architectural features and the lack of universal detection methods, leading to inefficiencies and low detection rates, especially with the increasing use of virtual machines by malicious programs.
Innovation Solution
A system and method that analyzes files executable on virtual stack machines by identifying parameters of file sections and virtual stack machine functions, creating data clusters, calculating checksums, and matching them against databases of safe and harmful files to determine if a file is harmful, using clustering rules and fuzzy checksums.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard antivirus detection methods (signature analysis, heuristic analysis) are used on virtual stack machines, then detection coverage is limited, but the complexity of the detection system increases
Solution Approach 1:
The patent replaces traditional mechanical antivirus detection methods (signature matching, heuristic analysis) with a statistical approach using checksums and probability calculations. Instead of manually analyzing code patterns, the system computes checksums of virtual machine function parameters and compares them against databases using statistical probability, substituting complex mechanical analysis with mathematical computation.
Solution Approach 2:
The patent changes the detection parameters from code-based signatures to checksum-based statistical parameters. By computing checksums of function parameters (number of operands, data types, stack depth) and comparing their statistical distribution against known safe and harmful files, the system transforms the detection problem into a parameter-based statistical analysis rather than code-based pattern matching.
2Object-affected harmful factors
If code obfuscation techniques are used by harmful programs, then detection difficulty increases, but the functionality of the programs is preserved
Solution Approach 1:
The patent replaces mechanical code analysis (which fails against obfuscation) with statistical checksum analysis. Since code obfuscation preserves functionality, the underlying parameter relationships remain statistically consistent. The system computes checksums of parameters like number of operands, data types, and stack depth, which remain relatively stable even when code is obfuscated, allowing detection without being affected by obfuscation techniques.
3Reliability
If heuristic analysis with emulation is used, then detection capability improves, but the time required for analysis increases
Solution Approach 1:
The patent performs preliminary action by pre-computing and storing checksums of virtual machine function parameters for both safe and harmful files in databases. Instead of performing full emulation and analysis at detection time, the system has already prepared statistical profiles during database construction, enabling rapid checksum-based comparison during actual detection without time-consuming emulation.
Solution Approach 2:
The patent substitutes time-consuming heuristic emulation with rapid checksum computation and statistical comparison. Rather than emulating program execution to analyze behavior, the system directly computes checksums of parameters and compares them against pre-built statistical databases, replacing mechanical emulation with mathematical operations that execute much faster.
4Measurement precision
If platform-specific detection algorithms are used, then detection accuracy for specific platforms improves, but the versatility across different platforms decreases
Solution Approach 1:
The patent creates a universal detection method that works across different virtual stack machine platforms by focusing on platform-agnostic parameters. The system computes checksums of parameters such as number of operands, data types, and stack depth, which are fundamental to stack machine architecture regardless of specific platform. This universal approach allows the same detection algorithm to function effectively across Java VM, Flash VM, and other stack-based virtual machines.
Data Source
AI summary
Disclosed are method and system for detecting harmful files executed by a virtual stack machine. An example method includes: analyzing a file executable on the virtual stack machine to identify both parameters of a file section of the file and parameters of a function of the virtual stack machine when executing the file; identifying, in a database, at least one cluster of safe files based on the identified parameters of the file section of the file and the identified parameters of the virtual stack machine; creating, using at least one clustering rule, a data cluster based on the identified at least one cluster of safe files; calculating at least one checksum of the created data cluster; and determining that the file executable on the virtual stack machine is harmful if the computed at least one checksum matches a checksum in a database of checksums of harmful files.