Abnormal Processor Detection with Memory and Dynamic Library Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying abnormal processors suffer from high false positives and fail to account for dynamic library insertions, leading to inefficiencies in distinguishing between normal and malicious processor activities.
Innovation Solution
Utilize machine learning models pre-trained on memory region and dynamic library information to identify abnormal processors, incorporating features like TF-IDF transformed memory region information, processor memory type, binary similarity, and dynamic library signatures, with a determination mechanism to consolidate results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If rule-based methods are used to identify abnormal processors, then the identification process is simple and fast, but the false positive rate is high and accuracy is low
Solution Approach 1:
The patent replaces rule-based mechanical identification systems with machine learning models that automatically learn patterns from memory region information and dynamic library data, thereby improving identification accuracy while reducing false positives without requiring manual rule configuration
Solution Approach 2:
The patent transforms traditional identification parameters by incorporating memory region information (such as authority, type, and binary similarity) and dynamic library characteristics (such as electronic signatures and usage history) as new features for the machine learning models, enabling more accurate detection of abnormal processors
2Reliability
If traditional identification methods are used, then the system is easy to implement, but it fails to account for dynamic library insertions leading to missed detections
Solution Approach 1:
The patent segments the identification system into two specialized machine learning models: one that analyzes memory region information and another that analyzes dynamic library information. This segmentation allows each model to specialize in specific aspects of processor behavior, improving overall detection reliability while maintaining manageable system complexity through modular design
Solution Approach 2:
The patent introduces a determination part that acts as an intermediary between the two machine learning models and the final identification result. This intermediary consolidates results from both models, coordinating their outputs to improve detection reliability while managing system complexity through structured integration
3Measurement precision
If multiple identification methods are combined, then the accuracy improves, but the processing time and computational resources increase
Solution Approach 1:
The patent divides the identification task into two parallel processing streams using separate machine learning models for memory region analysis and dynamic library analysis. This segmentation enables concurrent processing of different information types, improving identification accuracy while minimizing additional processing time through parallel execution
Solution Approach 2:
The patent implements a determination part that selectively consolidates results from the two machine learning models based on confidence levels and detection needs. This partial action approach ensures high accuracy for ambiguous cases while avoiding unnecessary processing time for clear-cut situations, optimizing the trade-off between accuracy and processing time
Data Source
AI summary
This application relates to an apparatus for identifying an abnormal processor. In one aspect, the apparatus includes a memory information collection part that collects memory region information and dynamic library information of a memory. The apparatus may also include a first identification part that identifies an abnormal processor by using a first machine learning model pre-trained based on the memory region information. The apparatus may further include a second identification part that identifies an abnormal processor by using a second machine learning model pre-trained based on the dynamic library information. The apparatus may further include a determination part that determines a final abnormal processor based on either the abnormal processor identified using the first machine learning model or the abnormal processor identified using the second machine learning model.