Webpage Code-Pattern Indexing for Low-Latency Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection techniques face challenges in achieving thoroughness and minimizing latency during in-line scanning of network traffic, especially with growing numbers of malware signatures exceeding hundreds of thousands, which complicates efficient detection.
Innovation Solution
Adaptive position-based indexing is employed to create a lookup infrastructure using alignment relative positional indexing schemes, allowing for highly efficient detection of malicious webpages by analyzing and determining the least number of indexes that cover most or all code patterns, with experiments showing over 99% match coverage and a search time of approximately 0.03 milliseconds per webpage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature detection is used with growing numbers of malware signatures, then detection thoroughness is improved, but scanning latency increases
Solution Approach 1:
The patent segments the malware signature database into multiple tables based on code pattern characteristics. Each table stores signatures with specific properties (e.g., table1 for patterns with certain characteristics, table2 for others), allowing the system to scan only relevant tables rather than searching through all signatures sequentially. This segmentation reduces scanning time while maintaining comprehensive detection coverage.
Solution Approach 2:
The patent introduces a new dimension to signature storage by organizing signatures according to code pattern alignment characteristics. Instead of a single flat database, the system creates a multi-dimensional structure where signatures are categorized by their positional relationships with code patterns, enabling faster retrieval and reducing the search space during scanning operations.
2Measurement precision
If comprehensive malware signature scanning is performed, then detection accuracy is improved, but processing speed decreases
Solution Approach 1:
The patent applies local quality by creating different table structures tailored to specific code pattern characteristics. Each table is optimized for its specific purpose, storing and indexing signatures with particular properties, which allows the system to process and compare signatures efficiently for each local category while maintaining overall detection accuracy.
Solution Approach 2:
The system performs preliminary organization of malware signatures into categorized tables during the indexing phase. This pre-processing action arranges signatures in advance according to their characteristics and positional relationships, so that during actual scanning operations, the system can directly access relevant tables without performing comprehensive searches, thereby improving processing speed while maintaining accuracy.
Data Source
AI summary
Building a highly efficient lookup infrastructure for malicious webpage detection is approached as a set covering problem. A malicious code patterns list is analyzed to determine which alignment relative positional indexing covers the most patterns with the least indexes. After determining which alignment relative positional indexes cover most, if not all, of the code patterns, the indexes are built. The alignment relative positional indexing schemes are stored to be applied to code patterns extracted from webpages when performing a lookup on the list of malicious code patterns for malicious webpage detection.