Cryptographic Hashing for Virus Localization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus software relies heavily on signature detection and integrity verification, which are ineffective against polymorphic and metamorphic viruses, and fail to accurately localize virus infections within files, leading to resource-intensive and inaccurate detection processes.
Innovation Solution
A method using cryptographic hashing to calculate hashes for sequences of file blocks, partitioning files, and comparing these hashes to identify and localize virus infections through collision-resistant hash functions, specifically designed for rewriting, appending, and embedding infection techniques, achieving precise localization and efficient detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If integrity verification techniques are used to detect virus infections, then detection capability is improved, but localization accuracy deteriorates because the technique only detects changes without indicating where changes occur
Solution Approach 1:
The patent divides the file into multiple blocks and calculates cryptographic hashes for each block individually. By comparing hashes of corresponding blocks between the original and suspected files, the system can precisely identify which specific block contains the virus infection, thereby achieving both detection and localization capabilities.
Solution Approach 2:
The patent introduces cryptographic hash values as an intermediary representation of file blocks. Instead of directly comparing raw file contents which would be resource-intensive, the hash values serve as compact intermediaries that enable efficient comparison and precise localization of infections with minimal resource consumption.
2Measurement precision
If comprehensive file scanning is performed to locate viruses, then localization accuracy is improved, but resource consumption increases
Solution Approach 1:
The patent extracts only the essential information needed for virus detection by calculating cryptographic hashes of file blocks. This extraction approach allows the system to focus computational resources on hashing operations rather than examining every byte of file content, achieving efficient localization with reduced resource consumption.
Solution Approach 2:
The patent transforms the file blocks into hash values, changing the parameter representation from raw binary data to condensed hash digests. This parameter transformation enables efficient comparison and localization while minimizing computational resources required, as hash calculations are much more resource-efficient than comprehensive file scanning.
3Productivity
If signature detection is used for known viruses, then detection speed is improved, but adaptability to new viruses deteriorates
Solution Approach 1:
The patent implements a universal hash-based detection mechanism that can detect both known and unknown viruses. By comparing cryptographic hashes of file blocks against stored original hashes, the system provides a multi-functional solution that maintains high detection speed for known viruses while automatically adapting to detect previously unseen malware variations without requiring signature updates.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods for using integrity checking techniques to identify and locate computer viruses are provided. A method for virus localization for each of three types of virus infections is provided, including the steps of computing a sequence of file blocks, calculating hashes for the sequences of file blocks from a host file and calculating hashes for the same or related sequences of file blocks from an infected file, and comparing the hashes from host file to the hashes from the infected file from the same or related sequences of file blocks such that when some of said first hashes and said second hashes do not match, a location of a virus is output. Methods are provided for computing the sequence of file blocks depending on the type of virus infection, and for calculating the hashes using a collision resistant hash function, a digital signature scheme, a message authentication code, or a pseudo-random function.