Abnormal Behavior Detection Model Using Word Vector Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current abnormal behavior detection mechanisms rely on pre-determined signatures or static features, making them ineffective against malicious programs with varying behavior sequences and susceptible to different Sandbox environment settings.
Innovation Solution
A method that performs part-of-speech analysis on program operation sequences to generate word vectors, clusters them, and uses supervised learning to build a classification model, allowing for the detection of malicious programs without relying on pre-determined signatures or static features, and is independent of Sandbox environment settings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If signature-based or static feature detection mechanisms are used, then the detection process is simple and fast, but the detection capability is limited and cannot resist malicious programs with confusion features
Solution Approach 1:
The patent transforms the static detection approach into a dynamic one by using deep learning models that can adapt to varying malware behaviors. The system dynamically adjusts detection strategies based on learned patterns from training data, enabling it to handle both simple and complex malicious programs effectively.
Solution Approach 2:
The patent changes the parameters of detection by transitioning from fixed signature matching to flexible feature-based detection using neural networks. The system learns optimal detection parameters from training data, allowing it to adapt to different malware types and environments without manual reconfiguration.
2Reliability
If dynamic analysis with Sandbox environment is used, then the detection can observe program behavior, but the detection results are affected by different Sandbox environment settings
Solution Approach 1:
The patent creates a universal detection model that functions across different Sandbox environments. By training on diverse environment data, the model learns environment-invariant features, enabling it to generalize detection capabilities across varying Sandbox configurations without being tied to specific environment settings.
Solution Approach 2:
The patent uses word embedding techniques to create abstract representations of program operations that copy the essential behavioral patterns while removing environment-specific noise. This abstraction allows the detection model to focus on intrinsic malware characteristics rather than environment-dependent variations.
3Ease of manufacture
If predetermined signatures or static features are used for detection, then the detection mechanism is simple to implement, but it cannot detect malicious programs with varying behavior sequences
Solution Approach 1:
The patent replaces the mechanical signature-matching system with an intelligent learning-based system. Instead of manually defining detection rules, the system automatically learns detection patterns from training data, substituting rigid mechanical processes with flexible computational learning approaches.
Solution Approach 2:
The patent performs preliminary training of detection models using extensive program operation sequence data before actual detection. This preliminary learning phase enables the model to acquire robust behavior patterns in advance, making it ready to detect varying malware sequences without requiring complex real-time analysis rules.
Data Source
AI summary
An abnormal behavior detection model building apparatus and an abnormal behavior detection model building method thereof are provided. The abnormal behavior detection model building apparatus analyzes the parts of speech of a plurality of program operation sequences in a plurality of program operation sequence data associated with abnormal behaviors to generate a plurality of word vectors and cluster the word vectors. Based on the result of the clustering, the abnormal behavior detection model building apparatus obtains a feature vector of each of the program operation sequence data, and perform a supervised learning for a classification algorithm by using the feature vectors so as to build an abnormal behavior detection model.