Virus File Clustering via Static PE Structure Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for cluster classification of computer viruses require significant human resources, time, and computer resources, and pose a risk of virus infection due to the need for dynamic analysis of virus files.
Innovation Solution
A method and device for statically analyzing binary data of virus files to extract PE structure data, comparing PE structure data for similarity, and performing secondary cluster classification using block-division and hash value comparison to classify virus files automatically, reducing the need for dynamic analysis and minimizing infection risk.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual dynamic analysis is used to classify virus files, then classification accuracy can be achieved, but significant human resources and time are required
Solution Approach 1:
The patent extracts static features from virus files before classification, preparing the data in advance. This preliminary extraction of features such as file headers, section information, and import tables enables subsequent fast automated classification without requiring time-consuming dynamic execution or manual analysis during the classification process itself.
Solution Approach 2:
The patent replaces manual mechanical analysis with automated computer-based classification systems. By using algorithms to compare extracted static features and automatically generate classification results, the system eliminates the need for human analysts to manually examine and categorize virus files, dramatically reducing time consumption while maintaining accuracy.
2Measurement precision
If dynamic running of virus files is performed for classification, then behavior features can be observed, but resource consumption increases
Solution Approach 1:
The patent extracts only the necessary static features from virus files that are sufficient for classification purposes, such as file structure information, section data, and import/export tables. By taking out only these essential features rather than performing complete dynamic analysis, the system achieves effective classification with minimal computer resource consumption.
Solution Approach 2:
The patent performs partial analysis by examining only specific portions of virus files (static features) rather than executing the entire file dynamically. This partial action approach provides sufficient information for classification without the excessive resource consumption required for complete dynamic analysis, achieving an optimal balance between feature detection and resource usage.
3Measurement precision
If dynamic running of virus files is performed for classification, then behavior analysis is possible, but virus infection risk increases
Solution Approach 1:
The patent performs preliminary extraction of static features from virus files before any classification or analysis takes place. By preparing and storing these static features in advance without executing the virus code, the system enables subsequent classification to be performed safely on the extracted data alone, eliminating the need to run the actual virus files and thus removing the infection risk entirely.
Solution Approach 2:
The patent introduces static feature extraction as an intermediary step between the virus file and the classification process. Instead of directly analyzing or running the virus file, the system first transforms it into safe static feature representations (such as structured data about file sections, imports, and headers), which then serve as the basis for classification. This intermediary transformation eliminates the harmful effect of virus execution while preserving the necessary analytical information.
4Productivity
If automated classification is implemented, then efficiency is improved, but complexity of the classification system increases
Solution Approach 1:
The patent segments the virus classification task into distinct modular components: static feature extraction, feature comparison, and classification decision-making. Each component handles a specific aspect of the classification process independently, making the overall system more manageable despite its automation. The segmentation allows efficient processing while keeping individual module complexities low.
Solution Approach 2:
The patent transforms the classification problem into parameter-based comparison by extracting specific measurable features (such as section counts, import table characteristics, and file structure parameters). By changing the approach from holistic analysis to parameter-based comparison, the system achieves high automated efficiency through straightforward parameter matching and threshold-based classification decisions.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
Disclosed are a clustering processing method and device for virus files. The method comprises: A. statically analyzing binary data of virus files to be clustered, so as to obtain PE structure data of the virus files; and B. comparing the PE structure data of the virus files to be clustered, and clustering the virus files having the PE structure data meeting a specific similarity into the same category. The device comprises: a first data analyzing module, used to statically analyze binary data of virus files to be clustered, so as to extract PE structure data of the virus files; and a first clustering module, used to compare the PE structure data of the virus files to be clustered, and cluster the virus files having the PE structure data meeting a specific similarity into the same category. The solution can improve the clustering efficiency of computer virus files, reduce resource consumption, and avoid the risk of virus infection caused by dynamically running the virus files.