Virus Detection Using Full Feature Hashing and Similarity Thresholds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virus detection methods based on point features are easily circumvented by virus developers and struggle to detect variations, particularly for viruses with small circulating ranges.
Innovation Solution
A virus program detection method that utilizes full characteristic features to generate unique sequences, calculates similarity parameters with sequences in an antivirus database, and determines files as infected when similarity parameters are below a preset threshold, employing algorithms like SIMHASH and Hamming Code distance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If virus detection is based on point features (character strings or code sequences), then the detection method is simple to implement, but the detection accuracy deteriorates because virus developers can easily circumvent it by modifying or obfuscating the virus code
Solution Approach 1:
The patent segments the virus file into multiple blocks and extracts features from each block independently. Instead of relying on a single point feature that can be easily modified, the system divides the file into segments and analyzes multiple features across these segments, making it harder for virus developers to circumvent detection by modifying isolated points in the code.
Solution Approach 2:
The patent combines multiple feature extraction methods (character string features, code sequence features, and file structure features) to create a composite feature set. This composite approach integrates different types of features that together provide more robust detection accuracy, overcoming the limitation of single point features being easily circumvented.
2Measurement precision
If virus detection uses full characteristic features to uniquely determine all components of a file, then the detection accuracy improves, but the computational complexity increases
Solution Approach 1:
The patent segments the file processing into distinct blocks with different feature extraction strategies. By dividing the file into manageable segments and applying appropriate feature extraction to each, the system achieves comprehensive coverage without overwhelming computational complexity, as each segment can be processed independently and efficiently.
Solution Approach 2:
The patent applies feature extraction selectively to different parts of the file based on their characteristics. Not all file components require the same level of analysis - the system applies appropriate feature extraction depth to each block, achieving sufficient detection accuracy without performing excessive computational operations on every single component.
Data Source
AI summary
This disclosure relates to detection of viruses. In one implementation, a virus detection method performed by a terminal device is disclosed. The method may include obtaining a full characteristic features of a first file, the first file being a sample file collected by a client application of the terminal device, and the full characteristic features of the first file being used to uniquely determine all components of the first file, obtaining a first binary hash sequence based on the full characteristic features of the first file and by using a preset hash algorithm, calculating similarity parameters between the first binary hash sequence and reference binary hash sequences in an antivirus database, each binary hash sequence in the antivirus database corresponding to one type of virus-infected file, and determining the first file as a virus-infected file when at least one of the similarity parameters is less than a preset similarity threshold.