Method and system for rapid signature search over encrypted content
View Patent ↗A method for detecting malware includes dividing data to be scanned for malware into at least a first data segment and a second data segment, dividing a signature corresponding to an indication of malware into at least a first signature segment and a second signature segment, performing a relationship function on the first signature segment and the second signature segment yielding a first result, performing the relationship function on the first data segment and the second data segment yielding a second result, comparing the first result and the second result, and, based on the comparison, determining that the data includes information corresponding to the signature. The relationship function characterizes the relationship between at least two information sets.
1. A method for detecting malware, comprising:
dividing a portion of data of an electronic device to be scanned for malware into at least a first data segment and a second data segment;
dividing a signature corresponding to an indication of malware into at least a first signature segment and a second signature segment, wherein said signature is not identical to the portion of data;
performing, by a processor, a mathematical relationship function on the first signature segment and the second signature segment, yielding a first result, the relationship function characterizing the relationship between at least two information sets;
performing said relationship function on the first data segment and the second data segment, yielding a second result;
comparing the first result and the second result;
based on the comparison, determining that the portion of data of the electronic device includes information corresponding to said signature so as to perform a search of said first two segments of the portion of data for said signature by using said relationship function for the detection of malware.
2. The method of claim 1 , wherein the relationship function includes a determination of the number of positive bits in each information set.
3. The method of claim 1 , wherein the relationship function includes an element-by-element comparison of whether the elements in a first information set are equal to the corresponding element in a second information set.
4. The method of claim 1 , further comprising determining that the data includes malware identified by the signature.
5. The method of claim 1 , wherein comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold.
6. The method of claim 5 , further comprising:
selecting a third signature segment and a fourth signature segment;
performing the relationship function on the third signature segment and the fourth signature segment, yielding a third result; and
comparing the third result and the second result.
7. The method of claim 1 , wherein comparing the first result and the second result includes determining whether the first result and the second result are equal.
8. The method of claim 1 , wherein comparing the first result and the second result includes determining whether the first result and the second result contain one or more repeating patterns in common.
9. The method of claim 1 , wherein comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold, and further comprising:
selecting a third data segment and a fourth data segment;
performing the relationship function on the third data segment and the fourth data segment, yielding a third result; and
comparing the third result and the first result.
10. The method of claim 1 wherein comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold; and
further comprising performing additional anti-malware processing on the portion of data based on the determining whether the similarity exceeds the similarity threshold.
11. The article of claim 10 , wherein comparing the first result and the second result includes determining whether the first result and the second result are equal.
12. The article of claim 10 , wherein comparing the first result and the second result includes determining whether the first result and the second result contain one or more repeating patterns in common.
13. The article of claim 10 , wherein:
comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold; and
the processor is further caused to:
select a third data segment and a fourth data segment;
perform the relationship function on the third data segment and the fourth data segment, yielding a third result; and
compare the third result and the first result.
14. The article of claim 10 wherein:
comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold; and
the processor is further caused to perform additional anti-malware processing on the portion of data based on the determining whether the similarity exceeds the similarity threshold.
15. The system of claim 14 , wherein comparing the first result and the second result includes determining whether the first result and the second result are equal.
16. The system of claim 14 , wherein comparing the first result and the second result includes determining whether the first result and the second result contain one or more repeating patterns in common.
17. The system of claim 14 , wherein:
comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold; and
the anti-malware application is further caused to:
select a third data segment and a fourth data segment;
perform the relationship function on the third data segment and the fourth data segment, yielding a third result; and
compare the third result and the first result.
18. The system of claim 14 wherein:
comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold; and
the anti-malware application is further caused to perform additional anti-malware processing on the portion of data based on the determining whether the similarity exceeds the similarity threshold.
19. A non-transitory computer readable storage medium having computer-executable instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
divide a portion of data to be scanned for malware into at least a first data segment and a second data segment;
divide a signature corresponding to an indication of malware into at least a first signature segment and a second signature segment, wherein said signature is not identical to said portion of data;
perform a mathematical relationship function on the first signature segment and the second signature segment, yielding a first result, the relationship function characterizing the relationship between at least two information sets;
perform said relationship function on the first data segment and the second data segment, yielding a second result;
compare the first result and the second result;
based on the comparison, determine that the portion of data includes information corresponding to said signature so as to perform a search of said first two segments of said portion of data for said signature by using said relationship function for detecting malware.
20. The article of claim 10 , wherein the relationship function includes a determination of the number of positive bits in each information set.
21. The article of claim 10 , wherein the relationship function includes an element-by-element comparison of whether the elements in a first information set are equal to the corresponding element in a second information set.
22. The article of claim 10 , wherein the processor is further caused to determine that the portion of data includes malware identified by the signature.
23. The article of claim 10 , wherein comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold.
24. The article of claim 23 , wherein the processor is further caused to:
select a third signature segment and a fourth signature segment;
perform the relationship function on the third signature segment and the fourth signature segment, yielding a third result; and
compare the third result and the second result.
25. A system for detecting malware, comprising:
a processor;
a non-transitory computer readable medium; and
an anti-malware application configured to protect an electronic device from malware, the anti-malware application including instructions carried on the non-transitory computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the anti-malware application to:
divide a portion of data to be scanned for malware into at least a first data segment and a second data segment;
divide a signature corresponding to an indication of malware into at least a first signature segment and a second signature segment, wherein said signature is not identical to said portion of data;
perform a mathematical relationship function on the first signature segment and the second signature segment, yielding a first result, the relationship function characterizing the relationship between at least two information sets;
perform said relationship function on the first data segment and the second data segment, yielding a second result;
compare the first result and the second result;
based on the comparison, determine that the portion of data includes information corresponding to said signature so as to perform a search of said first two segments of the portion of data for said signature by using said relationship function for the detection of malware.
26. The system of claim 14 , wherein the relationship function includes a determination of the number of positive bits in each information set.
27. The system of claim 14 , wherein the relationship function includes an element-by-element comparison of whether the elements in a first information set are equal to the corresponding element in a second information set.
28. The system of claim 14 , wherein the anti-malware application is further caused to determine that the portion of data includes malware identified by the signature.
29. The system of claim 14 , wherein comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold.
30. The article of claim 29 , wherein the anti-malware application is further caused to:
select a third signature segment and a fourth signature segment;
perform the relationship function on the third signature segment and the fourth signature segment, yielding a third result; and
compare the third result and the second result.