Methods for detecting malware

Abstract

In order to improve the efficiency of malware detection, a method is proposed that can process computer files (1) of different types and sizes while maintaining high detection performance by classifying a plurality of images (4) of different types (A, B, C, D, E), each of which is calculated or derived from a specific computer file under test (1) (CFUT) using an artificial intelligence method, such as machine learning, in particular deep learning, for example provided by a neural network (24) or a supervised deep learning algorithm. Different image transformation techniques are used to generate the different image types (A, B, C, D, E), and a plurality of methods are proposed to calculate an image (4) of uniform size Si containing relevant information for classifying the CFUT (1).

Description

Technical Field

[0001] The present invention relates to a method for detecting malicious software such as defective code or computer viruses. Such malicious software is usually contained in computer files, and these computer files may have constant or varying sizes.

[0002] The invention also relates to a computer system, a computer program and a computer-readable storage medium, such as a physical data carrier or a network resource, all relating to the above method. Background Art

[0003] Malware is generally considered to be software or code that has malicious properties, such as causing harm to users, computers, or networks. Malware can be categorized as known malware (i.e., previously categorized), potentially unwanted applications, and unknown binaries.

[0004] In the state of the art, there are two basic types of malware detection methods: in static analysis, observable artifacts of a software object are analyzed, and in dynamic analysis, information is generated dynamically by executing the software object under scrutiny.

[0005] Thus, in static analysis, malware is detected without executing the application or monitoring the runtime behavior of specific code. The classic static analysis technique is signature matching, in which a match is found with a malicious signature (which constitutes a kind of fingerprint for the malware). A significant drawback of this approach is that, as signatures are growing exponentially and becoming highly versatile, signature matching must keep up with the current development of malware signatures to be effective. With approximately 360,000 new malware samples attacking computer networks worldwide every day, approximately 70% of this malware exists only once, and approximately 80% of this malware disappears after an hour, keeping up with this rapid evolution of signatures is becoming an increasingly unattainable task.

[0006] On the other hand, a disadvantage of dynamic analysis is that such techniques can be very time-consuming and computationally intensive. As a result, dynamic malware analysis systems are often expensive to maintain and operate.

[0007] Another important challenge is that computer files vary greatly in size and structure. Therefore, it is mandatory to maintain high security for malware detection for computer files of random size and structure (including computer files with integrated sub-files).

[0008] Starting in the early 1980s, antivirus (AV) systems based on static signatures and heuristics dominated the market. In 1990, the first so-called sandbox systems entered the market, where malware was executed in a secure sandbox environment to allow for safe dynamic analysis. Around 2012, the first machine learning-based AV solutions became available. Summary of the Invention

[0009] Against this background, the central goal of the present invention is to achieve high classification performance for static malware analysis and surpass classical static analysis methods. A further object of the present invention is to develop a malware detection method that is highly adaptable to computer files of different types and sizes and is also very difficult to circumvent by malicious code architectures, in particular by obfuscation schemes.

[0010] According to the present invention, a method according to claim 1 is provided, which solves the aforementioned problems. In particular, the present invention proposes a method as described at the outset, further characterized in that a computer file under test (hereinafter referred to as CFUT) is processed by: converting the CFUT into image data comprising a plurality of different images; and classifying the image data using artificial intelligence methods, in particular machine learning methods, in particular deep learning, to detect malware. As a final step, if malware is detected, the CFUT can be safely isolated to provide protection against the malware, for example by using the method to isolate affected attachments of an email detected as containing malware.

[0011] Artificial intelligence can be understood as methods that can perceive, reason, act, or adapt. Machine learning methods are based on algorithms whose performance improves over time as they are exposed to more and more data. Standard machine learning methods use, for example, neural networks, decision trees, or other classification methods. Deep learning is a subset of machine learning in which multi-layered neural networks (NNs) learn from large amounts of data.

[0012] For processing, the CFUT can be temporarily stored in a memory. The CFUT can also be extracted from data traffic (e.g., traffic from a network connection). Such data traffic can also originate from a remote connection, particularly an Internet connection. The term computer file can be understood in a broad sense to include any type of binary data that is aggregated into data blocks. Therefore, the computer file under test (CFUT) 1 can have any file format. For example, it can be a standard PDF document or an executable file.

[0013] Images may differ in their visual appearance, i.e., in the underlying image data. For example, two color images of the same type and image size S may differ in the distribution of specific colors; or two black-and-white images may differ in the distribution of black pixels.

[0014] It is obvious to those skilled in the art that the method can be implemented by a computer, in particular, all steps of the method (as described herein) can be computer-implemented.

[0015] The present invention centers on transforming digital data (such as computer files) that may be affected by malware into images and then using machine learning methods to classify the images. Computer vision and related research fields have shown that robust and fast image-based classification is possible. The term classification here can be understood as meaning that a classification module (e.g., in the form of a multi-layer neural network) can classify a particular image as belonging to a particular image class corresponding to malware. Such classification can be based on training data in the form of image files derived from known malware.

[0016] In the above method, each of the multiple different images can be classified independently of the other images. Therefore, the method can assess the maliciousness of the CFUT based on the overall classification results of the multiple different images, particularly using a numerical result (yes / no). The results of this assessment can be used to trigger further actions within a computer system that may be affected by malware. Detected malware can be intentionally flawed code or simply an artifact that affects the normal operation or use of the CFUT.

[0017] Thus, each of the different image files can be processed by a separate image classification module based on machine learning from the training data. Furthermore, the classifier module can detect malware by processing the output of the image classification module. Such output can be generated in the form of a scalar (e.g., a pre-classification score between 0 and 100) or as a multi-dimensional output vector.

[0018] The above approach allows for robust malware detection by relying on image classification, which takes into account relevant semantic properties of the CFUT (particularly of internal data components).Importantly, malware detection can be based solely on static analysis of the CFUT.

[0019] In particular, the term "image" here can be understood as a multi-dimensional (e.g., 1.5D, 2D, 3D, 4D, etc.) representation of digital binary data. Rasterization can be used to convert such image data into a grid of pixels that can be used for visualization purposes (allowing humans to view such images), although the method can be implemented in computer software without relying on any such visualization (however, for optimization of manual-based classification, such as by fine-tuning the classification, visualization may be useful). In addition, the term "image" can be understood to describe any kind of data that represents a multi-dimensional vector space. In the simplest form, an image can be represented by an array of continuous data, where each data point represents a pixel of the image, i.e., a specific point within the vector space. Therefore, each such pixel can be represented by a plurality of bits that define the brightness and / or color and / or spatial position of the pixel.

[0020] Thus, such image data or images can be characterized in that they contain neighborhood information describing the spatial relationships between different data points (pixels) within the image. Thus, images used for malware classification can be characterized as data that allows for the calculation of spatial distances between the data points (i.e., pixels) that make up a single image. Such distances can be understood as a measure of the proximity between those data points in the vector space represented by the image data.

[0021] The image can have any spatial support. However, by using a spatial support with rectangular or even quadratic faces, the computation can be more efficient. The pixels of the image can have any shape. However, preferably, all pixels have the same shape. Thus, preferably, the image consists of a grid with N1 x N2 x N3 x ... x N d N entries in the pixel matrix representation, where d is the dimension of the matrix. i It can be any natural number, usually a multiple of 2. For example, a two-dimensional image can be represented by 256 x 256 pixels. Obviously, any image needs to be supported by associated image data (usually stored in a convenient image file format).

[0022] According to the invention, there are further advantageous embodiments which solve the above-mentioned problem, which are described in the dependent claims and below.

[0023] For example, it is recommended to use a separate and specific image classification module for each of the different image types used. Thus, at least two of the different images can each be classified by a separate image classification module. The output of the image classification module can then be evaluated by an additional classifier module to detect malware. To enhance malware detection performance, the image classification module and / or the classifier module can be trained using training images, which can be performed prior to classifying the image data.

[0024] It is further recommended to adopt a uniform image size, i.e. to use a specific image size S consistently for a specific type of image (and independently of the CFUT being studied). i (The image size S will therefore be static / constant), as this greatly benefits the machine learning approach. Thus, the CFUT may be transformed such that for at least one of the different images, and preferably for all of the different images, a corresponding uniform image size S is maintained that is independent of the size X of the CFUT i Maintaining a specific image size S independent of the CFUT to be converted can be achieved by using a lossless conversion in which all the data of the CFUT are taken into account, or by converting only part of the data contained in the CFUT and ignoring the rest of the CFUT. i In summary, according to such methods, a uniform image size S of a particular type of image can be maintained. i , without having to crop a specific image to its desired uniform image size S i .

[0025] Image cropping has the fundamental drawback of not generating a complete representation of the CFUT; for example, a cropped image might represent only a portion of the CFUT's body or footer. This creates the risk that a cropped image could be classified as being generated by a benign CFUT, even though the CFUT contains malware, potentially nested within the cropped portions of the image. Furthermore, images that could be individually classified as benign might be classified as malignant altogether. Therefore, image cropping poses a fundamental risk if not combined with other sophisticated methods.

[0026] Importantly, the plurality of different images may include several different image types. Each image type may be represented by a specific image size S i Therefore, the corresponding image sizes S1, S2, S3, etc. of some of the different images may be different, while some images, especially when they are of the same image type, may have the same image size. However, for a specific image type used in different images, for example, for a specific type of grayscale image, different sizes X may be used. i Convert various CFUTs into a unified image size Si In addition, different sizes of X i In this case, the training computer file can be converted into a uniform image size S of the image type classified by the module. i The training images are used as input to the image classification module for training.

[0027] In the context of the present invention, the terms "several" and "some" mean at least two, preferably at least three. Furthermore, the terms "repeatedly" and "series" refer to at least two elements.

[0028] In summary, there can be different uniform image sizes S i , each for a corresponding one of the different image types. In other words, the conversion of the CFUT may be such that for each of the different image types, a corresponding uniform image size S is maintained that is independent of the (current) size X of the CFUT i .

[0029] In detail, the method may include specifying a uniform image size S as a parameter that is independent of the size of the CFUT. Thus, the CFUT may be transformed so that one or more of the different images have the specified uniform image size S. An image classification module for classifying images of such size S may be trained using training computer files of different sizes; however, the training files may be converted into training images of the uniform image size S and used as input to the image classification module. Of course, there may also be different uniform image sizes S. i , each for a respective one of the different images, in particular for a respective image type. In other words, the transformation(s) of the CFUT may be such that for each of the different images a respective uniform image size S may be maintained that is independent of the size S of the currently investigated CFUT i .

[0030] Using different image types in multiple different images may have the effect that the different images have different sizes S i And / or there are differences in the corresponding underlying conversion algorithms used to calculate the specific image type and / or the corresponding pixel types used for the specific image type. For example, such different pixel types can be one-dimensional grayscale pixels or multi-dimensional color pixels.

[0031] An advantage of this approach is that each of the different image types employed can provide a different semantic representation of the CFUT. For example, the semantic representations provided by the different image types can differ in terms of information about the structure and / or composition and / or spatial distribution and / or density and / or statistics of the internal data components of the CFUT. Such internal data components can be data defined by the user / editor of the CFUT (which can be referred to as the "bacon") or data representing structural information (which can be referred to as the "skeleton").

[0032] Thus, the information provided by or derived from a single image in the image can include latent space representations as well as non-latent space representations, and both types can be used for classification of images. Latent space representations can be understood here as providing information about the CFUT that cannot be clearly observed from the raw data of the CFUT. In contrast, latent space representations must typically be derived from the raw data of the CFUT, for example by processing images obtained from the CFUT using a neural network. Because latent space representations can represent important (image) features of the original image, they can contain all the relevant information required to classify the original image and thus the CFUT.

[0033] By using different representations of the CFUT in the form of different image types, each of which provides a specific portion of information relevant to malware detection, the success rate of malware detection can be greatly improved. For example, even when the file size X of the CFUT varies greatly (e.g., due to the different sizes of the user-specific information (bacon) contained in the CFUT), the approach of using multiple different image representations of the CFUT (or a portion of the CFUT) will ensure that relevant information about the structure, randomness, or entropy of the data contained in the CFUT will still be fed into the classification with sufficient detail. This is because a single image in the different images can be customized to represent different semantic qualities / aspects / characteristics of the CFUT.

[0034] As already mentioned, the method can be based entirely on static analysis. Thus, image data can be classified entirely through static analysis, in particular without requiring dynamic interaction with the CFUT and / or without activating malware. This approach has the advantage of not requiring the execution of the CFUT, which could be potentially harmful, even in a sandboxed environment.

[0035] Another important suggestion for improving the robustness of detection and increasing the difficulty for malware itself to circumvent such detection is to compute images from randomly selected subsets of the data of the CFUT. For example, at least one of the different images can be an image computed from a subset of the data of the CFUT. In this case, the image size A of this particular image can be maintained independently of the size X of the CFUT, in particular by ignoring some of the data of the CFUT. i .

[0036] In this case, it is highly preferred if the subset is randomly selected from the CFUT and / or is selected independently of the CFUT's size X. For example, the subset can be selected by employing a random number generator. In this case, it is impossible to predict which data points of the CFUT will be considered for the calculation of the image and what the image will look like.

[0037] However, because the image is computed from the CFUT's data, it is a characteristic representation of the CFUT. In particular, even when a subset of the data is randomly selected, a malicious CFUT will produce certain characteristics in the image, and these characteristics can be detected using available machine learning methods. The random selection of data can follow a predetermined probability distribution, such as a uniform distribution or a distribution centered at different locations within the CFUT or within the image space defined by a specific image.

[0038] In order to maintain some locality of the data randomly extracted from the CFUT, it is advantageous if the subset of data randomly selected from the CFUT consists of sub-subsets of the data. These sub-subsets can each represent a specific local portion of the CFUT, in particular within a specific data segment of the CFUT. For example, a sub-subset can consist of three bytes that are immediately adjacent to each other in the CFUT. In other words, the data contained in one of these sub-subsets can be locally close to each other in the CFUT, in particular so that these data form a data string (e.g., a string of three bytes).

[0039] In order to provide a representative sampling of the data contained in the CFUT, the CFUT may be divided into data clusters. In other words, the subsets may be selected by dividing the CFUT into data clusters, preferably having a uniform cluster size, and forming subsets by randomly selecting data from within each cluster. In this case, a plurality of data points from a particular cluster within the clusters is used to calculate an image having a uniform image size S. i It is preferred that the pixels of the image are specific, preferably multi-dimensional. The pixel count can be based on the size of the image and the CFUT (e.g. based on r=X i / S iClusters are defined using a ratio r of 1 / 2 (r / 2). That is, data clusters can exhibit a uniform cluster size. Alternatively, cluster sizes can be randomly selected and / or variable cluster sizes can be used to further enhance the randomness of the selection of data subsets used to calculate the image. By using multidimensional pixels, the meaningfulness of the image can be increased because it represents more information than a simple grayscale image.

[0040] Additionally or alternatively, it is advantageous for efficient malware detection if the image space is filled with pixels by arranging the pixels in the image space defined by the image using a space filling curve, preferably a Hilbert curve. By using a space filling curve, the image space can be completely filled even when the ratio r=X i / S i When the difference is large.

[0041] The main advantage of using space-filling curves is that the locality of the information contained in the CFUT is better maintained in the image. This means that pixels close to each other in the image are computed from data that are close to each other within the CFUT. This approach of maintaining locality is particularly well-suited for convolutional neural networks, as these networks typically generalize image data using 2D rasterization (e.g., by generalizing an N x N pixel region to a single maximum / minimum / average value).

[0042] To increase the intensity and depth of the CFUT review, the process of randomly selecting data from the CFUT to calculate a specific image can be repeated. That is, the same CFUT can be repeatedly converted to a uniform image size S. i Each time, the corresponding image is calculated from a randomly selected data subset of the CFUT. Using this method, a (first) series of images can be obtained, all of which are calculated from different data subsets of the CFUT. Malware can then be detected by classifying this series of images sequentially or in parallel.

[0043] Preferably, the conversion can be repeated until all the data contained in the CFUT has been used at least once to calculate the series of images, most preferably at least to a certain predefined confidence level (e.g., after N repetitions, there will be a 90% confidence that all the data of the CFUT has been converted into images at least once). Although the same algorithm can be used to calculate the individual images of the first series of images, they will appear different because each of the images will be a representation of a different subset of the data of the CFUT. By repeating the conversion, more and more of the data of the CFUT can be represented as images until all the data contained in the CFUT is represented by at least one image in the series of images. In other words, the number of images to be generated can be selected depending on the file size X of the CFUT; the larger X is, the more images will be required.

[0044] Lossless mapping of data (particularly data without any zero padding) can be used to generate an image from the CFUT. To this end, the CFUT can be converted into a specific image by mapping (particularly rearranging) the data (preferably all data) contained in the CFUT to that specific image. This means that all pixels of at least one of the different images can be calculated from the data of the CFUT, in particular without relying on zero padding.

[0045] Another method for generating a specific type of image is to compute the image pixels from a sequence of data blocks (in particular from a sequence of bytes). If the resulting image size exceeds the desired uniform image size S i , then some of the pixels may be deleted until the number of pixels is sufficient to fill the image size S i For example, all pixels of at least one of the different images can be calculated from a corresponding sequence of (preferably adjacent) data blocks (in particular bytes) of the CFUT. In this case, the desired uniform image size S can be maintained by iteratively deleting pixels and thus using only a subset of the calculated pixels in the final image. i .

[0046] Another way to maintain a uniform image size that can be used alternatively or additionally is to use the so-called space-filling curve mentioned above. For example, a space-filling curve, most preferably a Hilbert curve, can be used to completely fill the image space defined by at least one of the images with pixels calculated from the data of the CFUT. In this case, each pixel of that particular image can represent the data contained in the CFUT. In addition, the CFUT can be converted into one of the different images by mapping (particularly rearranging) a sequence of data blocks of the CFUT using a space-filling curve, preferably a Hilbert curve.

[0047] A major advantage of using space-filling curves to convert a CFUT into image data is that—unlike reshaping and resizing an image obtained by simply transferring data directly from the CFUT—the image data can be obtained largely or completely undistorted, so that characteristics of the CFUT that are relevant to image classification can be preserved.

[0048] Another suitable type of image that can be used to enhance detection performance is an entropy image. Entropy here (as used in classical information theory, such as Shannon entropy) can be understood as a measure of the average amount of information, where a small entropy indicates a high order and therefore a low amount of information. Therefore, it is proposed to generate at least one of the different images from the CFUT by calculating the entropy of a data block of the CFUT. In this case, the pixel values ​​of the generated image can be given by the ratio of the calculated entropy divided by the total entropy of the CFUT, i.e. as a relative local entropy; for example, the pixel values ​​can be normalized to an interval ranging from 0 to 1 to indicate the local relative entropy of a specific data block within the CFUT.

[0049] The resulting entropy image can thus visualize the local entropy distribution within the CFUT. This is particularly helpful for detecting obfuscated code within the CFUT. Malware developers often use code obfuscation mechanisms to circumvent malware detection techniques, making it difficult for AV software to detect such malware. However, the use of multiple code obfuscation mechanisms (e.g., Packer or Cryptor) often produces high entropy. Therefore, the use of entropy images greatly improves malware detection, as such obfuscations can be detected as local hotspots of entropy.

[0050] In fact, any property of the CFUT that can be extracted as a numerical value can be used to convert the CFUT into an image to be classified. For example, an appropriate metric can be defined and applied to the CFUT to extract such values ​​and calculate an image from these values.

[0051] Furthermore, latent space representations can be extracted from images computed from CFUTs, particularly those described as vectors in a high-dimensional vector space, and such data can be evaluated for malware detection. For example, a CFUT can be represented as a color image by grouping / transforming consecutive bits or bytes into pixels and assigning a specific order to the pixels. Statistical properties or other data features can then be extracted from the color image, and these data can be analyzed in a vector space as a latent space representation of the image.

[0052] For example, convolutions can be used to generate increasingly generalized representations of the original image obtained from the CFUT until a latent space representation of the original image is achieved, which can then be used as input to a classifier module (such as a neural network or boosted tree).

[0053] In order to improve the detection rate, overlapping or identical parts of the CFUT may be converted into different images, in particular, into images of different image types.

[0054] For robust malware detection, it is also important to maintain locality information within the image obtained from the CFUT. Therefore, it is recommended to map different local data segments of the CFUT to corresponding image segments. To this end, the specific image can be obtained by segmenting the image space of at least one of the different images of size A into a plurality of image segments, by segmenting the CFUT into data segments, in particular data segments of consecutive data blocks, and by mapping different data segments of the data segments to different image segments of the image segments. For easier composition of the generated image, it is particularly advantageous if the image segments have rectangular, preferably square, surfaces. This also facilitates the use of space-filling curves when filling or defining the image segments.

[0055] In order to enhance the locality of the data representation within an image, it is proposed that, for at least one of the different images, pixels of the image be calculated from data blocks of the CFUT and that the pixels be reallocated among the blocks that populate the corresponding image segments of the image. In this case, it is particularly possible to calculate adjacent pixels within a particular image segment (and thus visualize this data block) from data blocks contained within a particular local data segment of the CFUT. Thus, following this approach, it is possible to spatially correlate a particular image segment with the corresponding data segment. Consequently, the locality of the CFUT information is maintained, at least within the image segment of the generated image.

[0056] The interpreted data redistribution can be tailored in particular to the needs of the convolution employed in the classification of the image. This may be the case, for example, if a convolutional neural network (CNN) or a convolutional XGBoost (ConvXGB) is used as an image classification module. To this end, at least one of the different images can be classified by an image classification module (in particular a convolutional classifier, such as a convolutional neural network) that processes the image with a convolution window of size C, and the image can thus be divided into image segments that match the size C of the convolution window. In this case, it is highly preferred if the image segments are filled with pixels calculated from data contained in the corresponding local data segments of the CFUT. In this way, the classifier can derive a meaningful latent space representation of the CFUT from the convolution of the image (e.g., by using an appropriate kernel or filter). In this case, the latent space representation derived from a specific image segment will be associated with the corresponding data segment of the CFUT. Depending on the image format to be processed, the size C of the convolution window can be different between different image classification modules in the image classification module.

[0057] In particular, a large computer file may actually be composed of several sub-files. In such cases, it is recommended to split the CFUT into sub-files and perform image conversion on each sub-file in the sub-files. In the case where a sub-file is detected as containing malware, the original CFUT can be classified as malicious. Therefore, the CFUT can first be split into sub-files, and each sub-file in the sub-files can be converted into a different image. Another method that can be used additionally or alternatively is to segment at least one image in the different images into multiple sub-images. In this case, the data contained in a sub-file in the sub-files of the CFUT can be mapped to a corresponding sub-image in the sub-image.

[0058] These steps may also be applied iteratively to further sub-sub-files contained in the sub-file of the CFUT, in particular to generate further sub-sub-images as part of a sub-image.

[0059] In order to improve the significance and information content of a specific image used in the detection of malware, the CFUT can be split into its skeleton and bacon (see above) before image conversion. Therefore, important structural information can be maintained, especially when processing a large CFUT. Therefore, the CFUT can first be divided into a skeleton file containing structural information (especially structural information about the type of CFUT) and a bacon file containing user-specific information characterizing the specific CFUT currently being studied. In this case, the skeleton file and / or the bacon file can each be converted into one of the different images for detecting malware. Preferably, this can be done by applying byte conversion (which will be described in detail below) to the skeleton file and / or the bacon file respectively. Afterwards, the corresponding image files obtained from the skeleton file and the bacon file can be classified respectively.

[0060] A further concept for maintaining a uniform image size for the different types of images used in the method is to downsize a portion of the CFUT and / or a sequence of data strings within the CFUT. Therefore, it is proposed that before or during the conversion of the CFUT into one of the different images, at least a portion of the CFUT (in particular, it may be the entire CFUT) is downsized into a reduced data set. In particular, and in contrast to selecting only a subset of data from within a portion of the CFUT (e.g., randomly), all data contained in a portion of the CFUT may contribute to the reduced data set. Thus, the reduced data set may represent all data contained in the portion or may be derived from all data contained in the portion.

[0061] According to this method, the part of CFUT can be further segmented into a sequence of data strings, and each data string can be reduced in size to smaller data blocks. In particular, this can be done so that all data of a particular data string contribute to the corresponding smaller data blocks.

[0062] It is also proposed to use multi-dimensional pixels to increase the amount of information in each image. In detail, the pixels of at least one of the different images can be given by an n-dimensional vector, preferably where n=1 or n=3. For example, for n=1, the image can be a grayscale image. For n=3, the image can be a color image, such as an RGB image. Additionally or alternatively, the pixels of at least one of the different images can have a value generated by the values ​​of several (preferably consecutive) bits or bytes of the CFUT, in particular so that the pixels are given by an n-dimensional vector. In such a case, it is preferred if the corresponding n components of the vector are generated by n adjacent data blocks (in particular n adjacent bytes) of the CFUT.

[0063] According to another possible embodiment of the method, a composite image composed of images that have been calculated from the CFUT can be used to further enhance the effectiveness of malware detection. To this end, at least two of the different images can be combined into a composite image. In other words, the image data obtained from the CFUT can include such a composite image. Preferably, the composite image has the same dimensions as the at least two different images (e.g., a 2D image). Suitable dimensions of the composite image are d=2, thereby forming a 2D image, or d=3, thereby forming a 3D image volume.

[0064] According to a particularly advantageous embodiment, a specific composite image can be designed that reveals the anatomy of the CFUT. Thus, at least one of the different images can be a composite image generated by combining an image of a first image type calculated from a randomly selected data subset of the CFUT and another image of a second image type that visualizes the local entropy of the CFUT. Most preferably, the composite image can also include a skeleton image and a Bacon image, preferably each a third or fourth image type, respectively, calculated from a skeleton file and a Bacon file derived from the CFUT, as previously explained.

[0065] The efficiency of malware detection can be further improved by evaluating characteristic data features of the CFUT (such as statistical data), in particular before image classification. Thus, a plurality of characteristic data features can be extracted directly from the CFUT, in particular without converting the CFUT into image data. These data features can then be fed into a separate data classification module, the output of which is taken into account in the detection of malware. In particular, the classifier module can take into account the output of the data classification module and the results of the image classification module for classifying different images in order to detect malware. The data classification module can be based on machine learning methods, similar to the image classification module.

[0066] A slightly different approach that may be used alternatively or additionally is to generate a matrix image from different data features of the CFUT, such as statistical data and metadata. To achieve this, N such data features may be extracted from the CFUT as N numerical values ​​and converted into a matrix image. The matrix image may be any kind of image, preferably a 2D or 3D image. Most preferably, the image data classified using a machine learning method comprises a matrix image. Malware may then be detected based at least in part on the classification results of the matrix image. In this approach, the N values ​​may each be normalized before conversion. In this way, each normalized value may be represented as a pixel in the matrix image. In particular, if the number N is smaller than the matrix image (which may advantageously have a uniform image size S i ), then the matrix image can be completed using zero padding (i.e. by filling the rest of the image with pixels having zero value).

[0067] As mentioned at the beginning, the classification of image data can be performed using state-of-the-art artificial intelligence methods (such as machine learning). Particularly suitable for the methods proposed herein are neural networks, as they are particularly effective in classifying multidimensional data. Therefore, at least one neural network (NN) (preferably a convolutional neural network (CNN)) and / or at least one decision tree (DT) can be used to classify the image data. In other words, the specific artificial intelligence method for classifying a specific image type, which can be implemented by one of the image classification modules, can be designed to operate on arrays of continuous data and / or data arranged in a multidimensional image file format (such as RGB color images). Therefore, the image classification module can be implemented as a neural network and / or the previously mentioned classifier module can be implemented as a decision tree.

[0068] Finally, the method can be further developed in the following aspects: at least two different latent space representations (in particular, at least two different latent space representations obtained from preprocessing at least two of the different images) can be classified to produce a pre-classification result, and the pre-classification result can be evaluated to detect malware. Such preprocessing can include convolution of the image and / or feature extraction from the image.

[0069] For example, a separate latent space classification module can be used to classify at least two different latent space representations of at least one of the different images to detect malware. Such representations can describe characteristics of the image relevant to malware detection and can be obtained, for example, from various hidden layers of a neural network (NN) processing one of the images obtained from the CFUT, and in particular also from several hidden layers of different NNs.

[0070] To address the aforementioned issues, the present invention further proposes a computer system, a computer program, and a computer-readable storage medium: To successfully execute the method, the computer system may include means for executing the various steps of the method as described above or as defined in one of the method claims. Similarly, the computer program may include instructions that, when executed by a computer, particularly the computer system just described, cause the computer / system to execute the method as described above or as defined in one of the method claims. Similarly, the computer-readable storage medium may include such instructions for the same purpose.

[0071] Preferred embodiments of the invention will now be described in more detail, although the invention is not limited to these embodiments: it will be obvious to a person skilled in the art that further embodiments of the invention can be obtained by combining the features of one or more patent claims with each other and / or with one or more features of the embodiments described or illustrated herein. In particular, countless combinations of the different image transformations and generated image types described herein can be advantageously used to detect malware within the CFUT. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] With reference to the accompanying drawings, in which features having corresponding technical functions are referenced with the same numerals even when these features differ in shape or design:

[0073] Figure 1 is a schematic flow chart illustrating various steps of a method for detecting malware according to the present invention,

[0074] Figure 2 is a schematic diagram of another possible implementation scheme of a classification engine according to the method of the present invention,

[0075] Figure 3illustrates the details of the file-to-image conversion method used,

[0076] Figure 4 This diagram shows a neural network that can be used as a classifier.

[0077] Figure 5 illustrates examples of grayscale images as they are obtained by direct bit-by-bit encoding of computer files of different sizes,

[0078] Figure 6 illustrates the use of a space-filling curve to completely fill a predefined image space having a given number of pixels calculated from a computer file.

[0079] Figure 7 Shown by using Figure 6 The image of uniform image size obtained by the space filling curve method shown in

[0080] Figure 8 Two examples of images of a first image type A obtained from benign (left) and malignant (right) PDF documents are shown,

[0081] Figure 9 Two examples of images of the second image type B showing the visualization of local entropy obtained from benign (left) and malignant (right) PDF documents,

[0082] Figure 10 illustrates a possible redistribution of pixels in an image calculated from a computer file under test,

[0083] Figure 11 Two examples of images of the third image type C are shown, namely two images calculated from the skeletons of benign (left) and malignant (right) test computer files,

[0084] Figure 12 Shows the Figure 11 Two examples of images with the same image type C but different image sizes, calculated from Bacon of benign (left) and malignant (right) test computer files.

[0085] Figure 13 Two composite images obtained by combining multiple other images derived from benign (top) or malignant (bottom) computer files are illustrated, and

[0086] Figure 14 Illustrated are two matrix images obtained from the transformation of data features contained in benign (top) and malignant (bottom) test computer files. DETAILED DESCRIPTION

[0087] Figure 1A possible design of a classification engine 32 is presented, which is implemented by software on a standard computer system and which performs the method for malware detection according to the present invention. As shown in the figure, a computer file under test (CFUT) 1 (for example, a standard PDF document temporarily stored in the memory of the computer system) is first converted into image data 3 using a conversion engine 20. The image data 3 includes a plurality 5 of different images 4, namely a first series 9a of different images 4 of a first image type A, a second series 9b of different images 4 of a second image type B, further images 4 of a third image type C, and several composite images 11 of a fourth image type E (each consisting of one image 4 of type A, one image 4 of type B, and two images 4 of type C (see Figure 13 )) and finally a further image 4 of a fifth image type F in the form of a matrix image 16. All these different images 4 have been calculated from the data contained in the CFUT 1.

[0088] For each image type (A, B, C, D, E), Figure 1 The engine 32 provides individual image classification modules 6 (6a..6e) in the form of respective neural networks 24 that have been pre-trained with training images to identify malicious content in respective images 4. In other words, the classification modules 6 classify the image data 3 using machine learning methods.

[0089] Machine learning algorithms, especially neural networks, usually require a constant size of the input vector. Therefore, each image classification module 6 is designed for a specific image size S that is maintained when converting the CFUT 1 to a specific image type A / B / C1 / C2 / D / E. i .

[0090] To detect any malware 2 contained in the CFUT 1, the output of the classification module 6 is evaluated by a classifier module 7 in the form of a decision tree 26, which delivers a final classification score 23 between 0 and 100, representing the probability that the CFUT is malicious (e.g., 0 = benign, 100 = malicious). Depending on this final classification score 23, the computer system executing the method can take further steps to securely isolate the CFUT, for example, if the score 23 indicates that the probability of the presence of malware 2 in the CFUT 1 is above a certain threshold.

[0091] Likewise, each neural network 24 employed delivers a pre-classification score 42 in the form of a numerical score value between 0 and 100. Alternatively, a classification module may also be used that delivers a multi-dimensional output vector representing a more complex classification result.

[0092] If you can Figure 1As can be seen in FIG. 1 , the first conversion engine 20 converts the CFUT 1 into images 4 of three different image types A, B, and C. This conversion is performed in such a way that a uniform image size S is maintained for each image 4 of a particular image type, regardless of the file size of the CFUT 1. i , for example maintaining the image size S1 for the images 4 of type A of the first series 9a . Consequently, there is no need to crop any of these images 4 so that all pixels contained in a particular image 4 are considered by the corresponding classification module 6 .

[0093] It is also possible to use subtypes of images 4, such as types C1 and C2, which are skeleton images 12 and Bacon images 13 of image type C, respectively, but differ in their corresponding uniform image sizes S3 and S4. This can be achieved by using different image classification modules 6c1 and 6c2 specifically designed for input of image size S3 or S4, respectively.

[0094] Figure 1 Also illustrated is the extraction of a plurality of characteristic data features 14 from the raw CFUT in parallel with the image conversion performed by the conversion engine 20 on image types A, B and C. These features are fed directly into a data classification module 15 in the form of a decision tree 26 which delivers another pre-classification score 42g.

[0095] Furthermore, the second image conversion engine 20 converts the data features 14 into a matrix image 16 of the image type E classified by the corresponding image classification module 6e. The module 6e also delivers a pre-classification score 42e.

[0096] Figure 1 The engine 32 includes a further neural network 24 implementing a latent space classification module 25. This module 25 evaluates the information processed by the image classification modules 6a, 6b, 6c1, 6c2, 6d and 6e; in particular, the module 25 evaluates the latent space representation 44 of the image 4 obtained in the hidden layer 30 of the neural network 24 serving as the image classification module 6 (see Figure 1 ). In detail, the latent space representation 44 is obtained from the last hidden layer 30 before the output layer 31 of the corresponding neural network 24, which delivers a minimal multidimensional representation of the corresponding image 4 that cannot be directly accessed from the CFUT 1. By collecting all these high-level representations and evaluating them in the latent space classification module 25, highly robust detection of malware 2 can be achieved.

[0097] Taking into account such multi-dimensional and high-level information obtained from pre-processing at least one of the different images 4 further improves the efficiency of malware detection. This can be done in particular by classifying such information against each other within a single deep learning-based classification model, such as implemented by module 25. Finally, module 25 then delivers a further numerical pre-classification score 42f.

[0098] exist Figure 1 It can also be seen in FIG. 1 that the generated composite image 11 consisting of one image 4 of type A, one image 4 of type B and one skeleton image 12 and one Bacon image 13 each of type C is classified by a separate image classification module 6d which delivers a pre-classification score 42d.

[0099] like Figure 1 As can be seen in FIG, all pre-classification scores 42 are fed into the classifier module 7, which determines the final classification score 23 based on eight individual pre-classification scores 42a-42g obtained by processing the image 4 calculated from the original CFUT 1 or by processing further data derived from the CFUT 1 (as in the case of modules 15 and 6e, which process the data features 14 and the latent space representation 44 processed by modules 6a-6e, respectively).

[0100] Thus, a method for detecting malware may be implemented by the classification engine 32, which includes

[0101] - A first level of classification supported by tree-based and / or supervised machine learning algorithms fed with data features (particularly statistical data and / or metadata) extracted from the CFUT 1 .

[0102] - a second layer of classification based on the detection of specific image features (especially supported by supervised deep learning algorithms); and

[0103] - A third layer of classification fed with the classification results from the first and second layers.

[0104] Figure 2 Another possible implementation of the method according to the present invention is shown. Figure 2 The engine 32 features an artificial intelligence stack 22 that combines Figure 1 The functions delivered by modules 6, 7, 15 and 25, and deliver a final classification score of 23.

[0105] Figure 2The engine 32 shown in FIG extracts a certain number of statistical data and metadata features 14 from the original CFUT 1 (for example, a total of 418 different features in the case of PDF files, but a different number in the case of other file formats) to collect quantitative characteristics specific to the particular CFUT 1, such as the presence and amount of known suspicious strings, obfuscated or encrypted data. While the method relies on static analysis of the CFUT 1, the statistical and metadata features are designed to not only quantify the internal composition of the CFUT 1, but also to extract indicators of malicious behavior and capabilities that have been historically explored but typically only detected during dynamic analysis and interaction.

[0106] Once the statistical and metadata features have been extracted, these quantitative data can be converted into another matrix image 16 that characterizes the CFUT 1. To obtain this matrix image 16, each feature value extracted from the CFUT is first normalized, for example, to an integer range from 0 to 255, so that the normalized value can be represented by a pixel of the image 16. After normalization, the vector of length 418 is reshaped into a two-dimensional array of size 21 x 21. Next, zero padding is applied to the difference between the 418 normalized values ​​contained in the vector and the total 21 x 21 = 441 pixels of the image. The resulting image 16 can provide a visual distinction between benign and malignant CFUTs 1.

[0107] It should be noted here that so far Figure 1 and Figure 2 All features explained are optional features that may or may not be implemented in the method according to the present invention, at least within the scope of claim 1. That is, in the simplest case, the classification engine 32 executing the method may include a conversion engine 20 for converting the CFUT 1 into image data 3 comprising a plurality of different images 4 (e.g., a stack 9a of three different images of type A), and at least one image classification module 6 for classifying the image data 3 based on a machine learning approach, which delivers a classification result indicating the presence of malware 2 in the CFUT 1. All other features of the method / the engine 32 may be considered optional.

[0108] like Figure 3As shown in , any binary code present in a computer file can be plotted as, for example, a grayscale image 4, 17. Image analysis techniques, in particular based on machine learning, can then be used to identify in such images 4 textural and structural similarities between malware from a specific malware family. Thus, the data-to-image conversion used in the method can rely on a so-called pixel conversion. Pixel conversion can be understood here as reading a byte of the CFUT and converting it into a value between 0 and 255 that directly corresponds to the pixel intensity (in grayscale value). In other words, pixel conversion can be achieved, for example, by using Figure 3 The binary bit-by-bit encoding matrix 27 shown in [4] converts a binary file consisting of a string of bytes into a one-dimensional stream of one-dimensional pixels of varying intensities / grayscales. The resulting stream of pixels can then be reshaped into a multidimensional object, in the simplest case into a two-dimensional grayscale image with M x N pixels, which can be stored as an image file. Thus, such an image 4 can represent a maximum of M x N bytes.

[0109] Alternatively, the byte string of the CFUT 1 can also be converted into multidimensional pixels 36, for example into RGB pixels; this type of pixel conversion is used for the generation of the image 4 of type A (see Figure 8 ).

[0110] like Figure 3 As can be seen, the structure 28 of the original computer file shown on the right can be identified in the image 4 shown on the left; in particular, the skeleton portion 40 and the bacon portion 41 can be identified in the image 4, which correspond to the skeleton 43 and the bacon 44 of the computer file shown on the right.

[0111] A convenient and efficient way to classify is to use a neural network (NN)24, such as Figure 4 , which can be used as a classifier. To this end, a latent space representation 44 can be generated by convolution of the image 4, which is then fed as input to the NN 24 acting as a classifier. As shown, such a network 24 can have an input layer 29, one or more hidden layers 30, and an output layer 31, which can deliver a multi-dimensional or one-dimensional output vector. Such a vector can represent a specific classification result of the image 4 obtained from the original CFUT1. Importantly, such a network 24 requires an input vector of a defined size that does not change.

[0112] Purely for illustrative purposes, Figure 5 The results of grayscale image conversion of two separate computer files that differ in file size are shown. As can be seen, the resulting image sizes (e.g., in terms of columns x rows or number of pixels) will be different. Such images 4 of different sizes cannot be efficiently classified by a single classification module / single neural network, or only with severe disadvantages.

[0113] Figure 6 A solution to this problem is presented, namely the use of so-called space filling curves 35. Maintaining a uniform image size S can be achieved by filling a predefined image space 8 with relevant pixels (preferably without zero padding) which are calculated from the data of the CFUT 1 and which therefore represent the important aspects of the CFUT 1 in the image 4. To this end, the image space 8 defined by a specific type of image (e.g. type A or B or C) is divided into different image segments 10, e.g. Figure 6 Next, the segments 10 are connected to each other by space-filling curves 35 (such as a first-order Hilbert curve), as shown in FIG. Figure 6 This process can be repeated iteratively, in particular so that one, several or all segments 10 are further divided into smaller sub-segments 39 in a similar manner, as shown in the upper right corner of FIG. Figure 6 These sub-segments 39 can then be connected using a space-filling curve 35 (such as a second-order Hilbert curve), as shown in the lower left corner of FIG. Figure 6 The second-order curve can be obtained by connecting the sub-segments 39 within the segment 10 by first-order Hilbert curves, respectively, and then by rotating these first-order curves and connecting them.

[0114] Thus, a general approach using the space-filling curve 35 may imply iteratively splitting a given image space 8 into image segments 10 (e.g., into a raster of 2x2 segments each time) and filling the resulting raster with pixels following the evolution of the space-filling curve 35 connecting all segments. By varying the depth of the splitting / iteration, the given image space 8 may be divided into a different number of segments (or sub-segments, or sub-sub-segments, which may all be considered segments), such that an image 4 of uniform image size S may be filled using a different number of pixels calculated from a CFUT 1 of a specific size X (which may be different).

[0115] As an example of a possible implementation using a space-filling curve for a CFUT 1 of different dimensions X, imagine an image of 8x8=64 pixels and a data set extracted from the CFUT corresponding to 59 pixels. In this case, the space-filling curve method can be used to fill 59 / 64 pixels using this data set. The remaining 64-59=5 pixels can then be filled with data extracted from the beginning of the data set. In this case, the last five pixels of the image will correspond to the first five pixels of the image because they are calculated from the same data from CFUT 1. However, the important thing is that each pixel of the image thus represents a meaningful amount of information from CFUT 1.

[0116] Now imagine a situation where a randomly extracted data subset would allow calculation of up to 69 pixels of CFUT 1 of size X, even though only 64 pixels are needed to produce a fully populated 8x8 pixel image. One option would be to discard 5 pixels, but in this case, the amount of information about CFUT 1 represented by those pixels would be lost. Alternatively, for example, the last data cluster from which data is randomly extracted, or some of the last data clusters, could be selected to be larger than the other data clusters of CFUT 1 from which the data subset was extracted. In other words, by varying the size of the data clusters from which data is extracted, the desired number of 64 pixels can be generated from CFUT 1, just enough to fill the 8x8 pixel image. Once again, in this approach, each pixel represents a meaningful amount of information about CFUT 1, where the last pixel is calculated based on data randomly selected from the data clusters from which the first pixels of the image are calculated, which are larger than the data clusters from which data was extracted. These are merely examples. Those skilled in the art can envision other variations on how to cope with small differences in uniform image size. Masking, modifying the image support, non-uniform pixel sizes, or stretching the data to the final image size via interpolation are other examples that can be employed to maintain a uniform image size. However, in all of these cases, using space-filling curves will preserve the overall locality of the data represented by the corresponding images.

[0117] exist Figure 7 The result of the space filling method as explained above is shown in FIG: Two images 4 of type A are obtained from two computer files of different sizes. These computer files can be converted into images 4 of different sizes, such as Figure 5 However, by using Figure 6 The space-filling curve method shown in can be used to obtain Figure 7 The image shown in 4 has a uniform image size S of N x M pixels that is independent of the size X of the underlying computer file. The advantage is Figure 7 The image 4 can therefore be classified by the same classification module 6a designed for a specific image size S (see Figure 1 ) for classification.

[0118] about Figure 6 The explained space filling curve method can be used to obtain an image 4 of any type, in particular type A, B or C. Since this method does not use zero padding, all pixels of the corresponding image 4 will be calculated from the data of the CFUT 1 and therefore represent information meaningful for classification.

[0119] For example, when applying the Hilbert curve 35 to a 2D image space 8 of 256 x 256 pixels, a maximum order of 8 can be used for the Hilbert curve. Since individual pixels cannot be further divided, such an image 4 can represent a maximum of 256 2= 65536 bits (in the case of a black and white image) or 65536 bytes (in the case of a grayscale image) of CFUT data.

[0120] In order to increase the amount of data represented by a particular image 4, multi-dimensional pixels can be used. For example, in Figure 8 In the case of the RGB color image 4, 18 of type A shown in FIG, three consecutive (i.e., adjacent) bytes (byte triplets) contained in CFUT 1 are represented by one RGB pixel 36, where each byte of the tuple defines a corresponding red, green, or blue value (between 0 and 255). In this way, the information contained in CFUT 1 can be visualized by color values. For an image size of 256 x 256 pixels, this means that a total of 65536 x 3 bytes = 192 kB can be represented in an RGB image without losing information. Because similar byte tuples will produce similar colors in image 4, correlations can be identified between similar data that are far away from each other within CFUT 1.

[0121] In case the size of the file to be converted is smaller than 192 kB, a lower order of the space filling curve 35 may be used, ie the image space 8 will be divided more coarsely into image segments 10 .

[0122] In the case where CFUT 1 exceeds 192 kB, a uniform image size S of the type A image 4 is maintained by converting only a portion of the data contained in CFUT 1 and ignoring the rest of CFUT 1 (except for using the space filling curve 35). Then, the type A image 4 is calculated based only on the corresponding data subset randomly extracted from CFUT 1. In order to maintain uniform sampling of CFUT 1, CFUT 1 can be divided into data clusters, and data can be randomly selected from each cluster to form a subset. The resulting image 4 can be a color image 4, 18 of 3-dimensional RGB (red / green / blue) pixels 36, such as Figure 8 As shown in .

[0123] Because the file size X of CFUT 1 can vary greatly, for a given image size S, the random selection of data in the case of image type A will be more or less rough compared to the random sampling of CFUT 1. Therefore, the series 9 of images 4 of type A are calculated, as Figure 1 9a at the top. Each image 4 in the series 9a differs in that it represents a different subset of the data of the CFUT 1. The larger the CFUT 1, the more images 4 of type A can be calculated (and later classified using the image classification module 6a), thereby increasing the amount of data from the CFUT 1 that has been (randomly) sampled and converted into images 4.

[0124] The method of using data clusters and randomly selecting a data subset from which to calculate the image 4 can also be applied to entropy images 4 of type B or images of type C.

[0125] In the case of image type C (see Figure 11 and 12 ), maintaining a uniform image size S can be achieved by considering a lossless byte conversion of all data contained in CFUT 1 i In other words, all data contained in CFUT 1 is first considered to calculate a large number of pixels; afterwards, some of the calculated pixels may be discarded, i.e., only a subset of the calculated pixels may be present in the final image. Alternatively, CFUT 1 may be downsized before the image conversion, and this downsizing may also take into account all data contained in CFUT 1.

[0126] For example, consider an image space 8 of 128 x 128 RGB pixels. Such an image can visualize a total of 16384 x 3 bytes = 49 kB. Therefore, if the file to be converted (e.g., it can be part of CFUT 1) is larger than 49 kB, it can first be converted into a continuous byte string, and then every second byte of the string can be deleted, thereby creating a reduced data set. If this reduction is insufficient, the reduction of the string can be repeated, for example, by deleting every third byte of the already reduced string, that is, in this case, the data string of three consecutive bytes is therefore reduced in size to a data block of two bytes. In this way, a reproducible sampling of CFUT 1 is performed, and the bytes remaining after the reduction in size are finally used to define the RGB pixels.

[0127] As a result, all pixels of the image 4 can therefore be calculated from corresponding sequences of adjacent data blocks 38 of the CFUT 1 (in particular from bytes that are very close to each other within the CFUT 1), which is Figure 11 and 12 This is the case in images 4 of type C shown in . However, there is no direct visualization (e.g., line by line) of the reduced byte strings used to calculate these images 4. Instead, the pixels 36 calculated from the reduced byte strings are redistributed.

[0128] To illustrate, Figure 10 A simplified example of a possible reallocation of pixels calculated from a one-dimensional byte string obtained from CFUT 1 is shown. The one-dimensional stream of pixels 36 is not simply filled row by row into the image space 8. Instead, the pixels 36 are reallocated into blocks that fill corresponding image segments 10 of the image 4. This type of reallocation is characterized in that neighboring pixels within a particular image segment 10 of the image 4 (e.g., pixels #10-18) are calculated from data blocks 38 of CFUT 1, which are contained within a particular local data segment 43 of CFUT 1 (see Figure 3 Because a particular image segment 10 and the corresponding data segment 43 are therefore spatially correlated, the locality of the information is preserved, i.e., pixels 36 that are very close to each other represent binary data that are spatially close to each other within the CFUT 1. In summary, the original CFUT 1 has been divided into different data segments 43, which have then been individually mapped onto different image segments 10 of the final image 4.

[0129] Figure 10 Also visible is the convolution window 45, which is used by the convolutional neural network 24 to process Figure 10 4. As can be seen, it is recommended that the image segment 10 matches the size C of the convolution window 45, because in this case the latent space representation derived from the convolution of the image segment 10 will be correlated with the underlying data contained in the corresponding data segment 43 of the CFUT 1.

[0130] The skeleton content of CFUT (1) has been extracted first as a skeleton file and then the skeleton file is converted into an image 4 of type C1 (see Figure 1 ) and calculated Figure 11 12. This is done by first converting the skeleton file into a byte string, reducing the byte string as explained above, where 3 consecutive bytes of the reduced string define one RGB pixel, and then reallocating the pixels as explained before.

[0131] An image of type B is an image 4 that visualizes the Shannon entropy of a local data block contained in the CFUT 1. This is done by calculating the ratio of the local Shannon entropy of the data block to the total Shannon entropy of the CFUT 1 as a merit number and plotting these local relative entropies after normalization. The resulting image 4 can be a color image 18 of one-dimensional pixels 37, such as Figure 9 As shown in .

[0132] A particularly efficient solution is to use Figure 13 1. Such an image can be obtained by combining type A, B, and C images 4. For such a composite image 11, some image cropping can be tolerated, especially when using sub-images of different image sizes. Type A images 4 can be images of uniform image size by mapping a random selection of data contained in CFUT 1 to the image space 8 of image 4. Type B images 4 are entropy images 4, which can be obtained by calculating the entropy of a data block of CFUT 1 and visualizing this entropy as a ratio of the total entropy of CFUT 1. Type C images 4 can be obtained by applying a byte conversion to CFUT 1, as explained above.

[0133] In summary, a method is proposed that can process computer files 1 of different types and sizes while maintaining high detection performance by classifying a plurality of images 4 of different types (A, B, C, D, E), each of which is calculated or derived from a specific computer file under test 1 (CFUT) using artificial intelligence methods such as machine learning, in particular deep learning, such as provided by a neural network 24 or a supervised deep learning algorithm. Different image transformation techniques are used to generate the different image types, and a number of methods are proposed to calculate an image 4 of a uniform size Si containing relevant information for classifying the CFUT 1.

[0134] / LIST OF REFERENCE NUMERALS LIST OF REFERENCE NUMERALS 1 Computer File Under Test (CFUT)

[0135] 2. Malware

[0136] 3 Image Data

[0137] 4 images

[0138] 5+(4)

[0139] 6 Image Classification Module

[0140] 7 Classifier Module

[0141] 8 (defined by 4) image space

[0142] Series of 9 images

[0143] 10(4) image segments

[0144] 11 Composite Image

[0145] 12 Skeleton Image

[0146] 13 Bacon Images

[0147] 14(1) Data characteristics

[0148] 15 Data Classification Module

[0149] 16 Matrix Image

[0150] 17 Grayscale image (one-dimensional pixels have values ​​from 0..255)

[0151] 18 Color images (pixels can have 1-3 dimensions: e.g., R or R / G / B) 19 Latent space concatenation and classification

[0152] 20 conversion engines (from 1 to 4)

[0153] 21 Data feature extraction

[0154] 22 AI Stack

[0155] 23 Final classification score

[0156] 24 Neural Networks

[0157] 25 Latent Space Classification Module

[0158] 26Decision Tree (DT)

[0159] 27 Coding Matrix

[0160] 28(1) structure

[0161] 29 Input Layer

[0162] 30 hidden layers

[0163] 31 Output layer

[0164] 32 Classification Engine

[0165] 33 Skeleton

[0166] 34 Bacon

[0167] 35 Space-Filling Curve

[0168] 36 multi-dimensional pixels

[0169] 37 one-dimensional pixels

[0170] 38 data blocks

[0171] 39 sub-segments

[0172] 40(4) skeleton part

[0173] 41(4 of) bacon portions

[0174] 42 Pre-classification score

[0175] 43 Data segment

[0176] 44(4) Latent Space Representation

[0177] 45 convolution window

Claims

1. A method for detecting malware (2), wherein a computer file CFUT (1) to be tested is processed by the following steps: - converting the CFUT (1) into image data (3) comprising a plurality of different images (4), - wherein the plurality of different images (4) include images of different image types (A, B, C, D, E) of the form of different graphical representations of the portion of the computer file under test (1), - wherein each image type (A, B, C, D, E) provides information about a specific portion of the computer file (1) under test that is relevant to the detection of malware; - using artificial intelligence methods to classify image data (3) to detect malware, - wherein each image of the plurality of different images (4) is classified independently of the other images (4), and - wherein the malignancy of the computer file (1) under test is assessed based on the overall classification results of the plurality of different images (4).

2. The method according to claim 1, -Where malware (2) includes defective code or computer viruses.

3. The method according to claim 1, -Artificial intelligence methods include machine learning methods.

4. The method according to claim 1, - wherein at least two of the different images (4) are each classified by a separate image classification module (6).

5. The method according to claim 4, -where the output of the image classification module (6) is then evaluated by the classifier module (7) to detect malware.

6. The method according to claim 5, - wherein the image classification module (6) and / or the classifier module (7) are trained using the training images prior to the classification of the image data (3).

7. The method according to claim 1, - wherein the CFUT (1) is transformed so that for at least one of the images (4) a corresponding unified image is maintained that is independent of the size X of the CFUT (1) Like size S i .

8. The method according to claim 7, - wherein the CFUT (1) is converted by using a lossless conversion that considers all data of the CFUT (1) or by converting only part of the data contained in the CFUT (1) and ignoring the rest of the CFUT (1).

9. The method according to claim 7, - without cropping a particular image to its desired uniform image size S i Convert CFUT(1) in the case of .

10. The method according to claim 1, - wherein the plurality of different images (4) comprises several different image types (A, B, C, D, E), wherein each image type (A, B, C, D, E) is composed of Specific image size S i To represent, - making at least some of the different images (4) different in the following respects - their corresponding image sizes S i and / or - the corresponding underlying conversion algorithm used to calculate the specific image type (A, B, C, D, E), and / or - The corresponding pixel class for a specific image type (A, B, C, D, E) type, or - making each of the different image types (A, B, C, D, E) employed provide a different semantic representation of the CFUT (1).

11. The method according to claim 1, - wherein the image data (3) are classified entirely by static analysis without dynamic interaction with the CFUT (1) and / or without activation of malware (2).

12. The method according to claim 1, - wherein at least one of the different images (4) is an image (4) calculated from a subset of the data of the CFUT (1), - Enables independence to be maintained by ignoring some of the data of CFUT(1) Image size S of size X of CFUT (1) i .

13. The method according to claim 12, - wherein the subset is randomly selected from the CFUT (1) and / or the subset is selected independently of the size X of the CFUT (1) and / or wherein the subset is selected by employing a random number generator.

14. The method according to claim 12, - wherein the subsets are selected by partitioning the CFUT (1) into data clusters with a uniform cluster size and by randomly selecting data from within each cluster to form the subsets.

15. The method according to claim 14, - wherein a uniform image size S is calculated using multiple data points within a specific cluster from the clusters i a particular multidimensional pixel of said image (4), and / or - wherein an image space (8) is filled with pixels by arranging said pixels in an image space (8) defined by said image (4) using a space filling curve.

16. The method according to claim 12 or 14, wherein the same CFUT (1) is repeatedly converted into images (4) of uniform image size Si, each time the corresponding image (4a, 4b, 4c, 4d) being calculated from a randomly selected subset of the data of the CFUT (1), to form a series (9) of images (4a, 4b, 4c, 4d) each calculated from a different subset of the data of the CFUT (1), and - wherein malware is detected by classifying said series (9) of images (4a, 4b, 4c, 4d) sequentially or in parallel, - wherein the conversion is repeated until said series (9) of all data contained in the CFUT (1) has been used at least once to calculate the image (4) at least to a certain predefined confidence level.

17. The method according to claim 1, - wherein the CFUT (1) is converted into a specific image (4) among the different images (4) by mapping the data contained in the CFUT (1) to the specific image (4), and / or - wherein all pixels of at least one of the different images (4) are calculated from data of the CFUT (1) without relying on zero padding.

18. The method according to claim 17, - wherein mapping the data contained in CFUT (1) includes reordering all data contained in CFUT (1).

19. The method according to claim 1, - wherein all pixels of at least one of the different images (4) are calculated from a corresponding sequence of adjacent data blocks (38) of the CFUT (1).

20. The method according to claim 19, - where the pixels are iteratively deleted and thus only the pixels in the final image (4) are used. The subset of pixels calculated to maintain a uniform image size S i .

21. The method according to claim 1, - wherein an image space (8) defined by at least one of the images (4) is completely filled with pixels (36 or 37) calculated from data of the CFUT (1) using a space filling curve (35), - such that each pixel of the at least one image (4) represents data contained in the CFUT (1), and / or - enabling the conversion of the CFUT (1) into images in different images (4) by mapping a sequence of data blocks (38) of the CFUT (1) using a space filling curve (35) An image (4).

22. The method according to claim 15 or 21, - wherein the space filling curve (35) comprises a Hilbert curve.

23. The method according to claim 21, - wherein mapping the sequence of data blocks (38) of the CFUT (1) comprises reordering the sequence of data blocks (38) of the CFUT (1).

24. The method according to claim 1, - wherein at least one of the different images (4) is generated from the CFUT (1) by calculating the entropy of a data block (38) of the CFUT (1).

25. The method according to claim 24, - wherein the pixel values ​​of said at least one of the different images (4) are given by the ratio of the calculated entropy divided by the total entropy of the CFUT, and / or - wherein the pixel values ​​are normalized to an interval ranging from 0 to 1.

26. The method according to claim 1, - wherein the specific image (4) is obtained by segmenting an image space (8) of a specific image (4) among different images (4) into a plurality of image segments (10), segmenting a CFUT (1) into data segments (43) of consecutive data blocks (38), and by mapping different data segments (43) among the data segments (43) onto different image segments (10) among the image segments (10).

27. The method according to claim 26, - wherein the image segment (10) has a rectangular surface.

28. The method according to claim 1, - wherein pixels (36, 37) of at least one of the different images (4) calculated from the data block (38) of the CFUT (1) are reallocated in the blocks of the corresponding image segment (10) filling the image (4), - causing neighboring pixels (36, 37) within a specific image segment (10) to be calculated from a data block (38) contained within a specific local data segment (43) of the CFUT (1), - spatially correlating a particular image segment (10) and a corresponding data segment (43).

29. The method according to claim 1, - wherein at least one image (4) of the different images (4) is classified by an image classification module (6) that processes the image (4) using a convolution window (45) of size C, and the image (4) is divided into image segments (10) that match the size C of the convolution window (45).

30. The method according to claim 29, -Wherein the image classification module (6) comprises a convolutional neural network (24).

31. The method according to claim 29, - wherein the image segment (10) is filled with pixels (36) calculated from data contained in the corresponding local data segment (43) of the CFUT (1).

32. The method according to claim 1, - wherein the CFUT (1) is split into sub-files, and each of the sub-files is converted into a different image (4).

33. The method according to claim 32, - wherein an image (4) of the different images (4) is segmented into a plurality of sub-images, and wherein data contained in one of the sub-files is mapped to a corresponding one of the sub-images.

34. The method according to claim 32 or 33, - wherein the steps are iteratively applied to further sub-subfiles contained in the subfile to generate further sub-subimages.

35. The method according to claim 1, wherein the CFUT (1) is first divided into a skeleton file containing structural information about the CFUT (1) and a Bacon file containing user-specific information characterizing the CFUT (1).

36. The method according to claim 35, - wherein the skeleton file and / or the Bacon file are each converted into one of the different images (4) by applying a byte conversion to the skeleton file and / or the Bacon file, respectively. Image (4).

37. The method according to claim 1, - wherein before or during the conversion of the CFUT (1) into one of the different images (4), at least a portion of the CFUT (1) is downsized into a reduced data set, - causing all data contained in said portion of the CFUT (1) to contribute to the reduced data set.

38. The method according to claim 37, - wherein said portion of the CFUT (1) is further segmented into a sequence of data strings, and each data string is reduced in size into a smaller data block such that all data of the data string contributes to the smaller data block.

39. The method according to claim 1, - wherein the pixels of at least one of the different images (4) are given by an n-dimensional vector, and / or - wherein a pixel of at least one of the different images (4) has a value resulting from the value of several consecutive bits or bytes of the CFUT, whereby the pixel is given by an n-dimensional vector.

40. The method according to claim 39, - wherein the respective n components of the vector are generated by n adjacent data blocks of the CFUT.

41. The method according to claim 1, - wherein at least two of the different images (4) are combined into a composite image (11), so that the image data (3) include the composite image (11).

42. The method according to claim 41, - wherein the composite image (11) has the same dimensions as the at least two images (4) of the different images (4).

43. The method according to claim 1, - wherein one of the different images (4) is a composite image (11) produced by combining the following images - an image (4) of a first image type (A) computed from a randomly selected subset of the data of the CFUT, and - An image of the second image type (B) visualizing the local entropy of the CFUT.

44. The method according to claim 43, - wherein the composite image (11) is generated by further combining the following images - A skeleton image (12) and a Bacon image (13) having a third image type (C) calculated from the skeleton file and the Bacon file respectively derived from the CFUT.

45. The method according to claim 1, - wherein a plurality of characteristic data features (14) are extracted directly from the CFUT (1) without converting the CFUT (1) into image data, and the plurality of characteristic data features are fed into a separate data classification module (15), the output of which is used to detect malware (2).

46. ​​The method according to claim 45, - wherein the classifier module (7) takes into account the output of the data classification module (15) and the results of the image classification module (6) for classifying different images (4) in order to detect malware (2).

47. The method according to claim 1, - wherein N different data features (14) are extracted from the CFUT as N numerical values ​​and converted into a matrix image (16), wherein the image data (3) includes the matrix image (16).

48. The method according to claim 47, - wherein malware (2) is detected based in part on the classification results of said matrix image (16), and / or - wherein before the conversion, the N values ​​are each normalized so that each normalized value can be represented as a pixel in the matrix image (16), and / or -wherein zero padding is used to complete the matrix image (16).

49. The method according to claim 1, - wherein at least two different latent space representations (44) obtained from pre-processing at least two of the different images (4) are classified to produce a pre-classification score (42f), said pre-classification score (42f) being evaluated to detect malware (2), and / or - wherein the latent space classification module (25) classifies at least two different latent space representations (44) of at least one image (4) of the different images (4) to detect malware (2).

50. The method according to claim 1, - wherein at least one neural network NN and / or at least one decision tree DT is used to classify the image data (3), and / or - wherein the artificial intelligence method for classifying image data (3) is designed to operate on - arrays of contiguous data, and / or -Data arranged in a multi-dimensional image file format.

51. The method according to claim 50, - wherein the artificial intelligence method for classifying image data (3) comprises an image classification module (6).

52. A computer system comprising means for performing the steps of the method according to one of claims 1 to 51.

53. A computer-readable storage medium comprising instructions that, when executed by a computer, cause the computer to perform the method of one of claims 1-51.

Images