Word Recognizer Discriminating Text for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity methods, such as signature-based filters, are ineffective in detecting malware packaged within network traffic using commonplace transfer encodings, as they fail to distinguish between natural language text and non-text content like binary data encoded in alphabetic sequences.
Innovation Solution
A system utilizing a word recognizer with language data compiled using finite state automata and control logic to differentiate between natural language text and non-linguistic text, where non-linguistic text is identified and decoded back into binary form to detect potential malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based filters are used to detect malware, then known viruses can be identified, but attacks exploiting commonplace transfer encodings cannot be reliably detected
Solution Approach 1:
The patent changes the detection parameter from signature matching to statistical analysis of text properties. By analyzing word length distribution, character frequency, and entropy metrics, the system transforms how malware is detected, enabling identification of both known and novel threats without relying on predefined signatures.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a statistical analysis system. Instead of comparing input against known virus patterns, the system uses probabilistic models to evaluate whether encoded content represents natural language or binary data, thereby detecting malware regardless of whether it is known or novel.
2Productivity
If transfer encodings are used to encode binary data, then data can be transmitted over text-based protocols, but security tools cannot distinguish between natural language text and encoded binary data
Solution Approach 1:
The patent applies the concept of color changes by transforming the invisible properties of text into visible statistical characteristics. By analyzing word length distributions, character frequencies, and entropy, the system makes the distinction between natural language and encoded binary data detectable, similar to how color changes make invisible differences visible.
Solution Approach 2:
The patent introduces statistical metrics as an intermediary between the raw encoded text and the security analysis. These metrics (word length distribution, character frequency, entropy) serve as mediators that translate the properties of transfer-encoded data into analyzable forms, enabling security tools to distinguish encoded binary data from natural language.
3Reliability
If conventional virus checking tools are used, then known viruses can be blocked, but they fail to provide security against attacks using transfer encodings
Solution Approach 1:
The patent implements a universal detection system that handles both known viruses and encoding-based attacks through a single statistical analysis framework. The system analyzes text properties to determine whether content is natural language or encoded binary data, providing multi-functional security protection without requiring separate mechanisms for different threat types.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The different advantageous embodiments provide a system for text discrimination comprising a word recognizer and control logic. The word recognizer has language data compiled using a number of finite state automata. The control logic is configured to operate the word recognizer to accept or reject a number of characters as a word.